How do I delete a stack instance from a CloudFormation stack set in a closed or suspended AWS account?

Last updated: 2021-08-30

I want to delete a stack instance from an AWS CloudFormation stack set, but the deletion fails because the target AWS account is closed or suspended.

Short description

When an AWS account is closed or suspended, the CloudFormation StackSets administration role can no longer access the StackSets execution role in that account. This prevents stack set operations from running on stack instances for that account. If you try to delete a stack instance in a closed or suspended account, you can get an error message. Then, the stack instance status can change to INOPERABLE.

To delete stack instances for closed or suspended accounts, you must perform the DeleteStackInstances operation with the RetainStacks option set to true. This decouples the stack instance from the stack set without deleting the stack instance in the target account.

The following resolution steps depend on the permissions model that the stack set uses: self-managed permissions or service-managed permissions with AWS Organizations.

Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.

Resolution

Delete inoperable stack instances for stack sets with self-managed permissions

For stack sets that use self-managed permissions, you can delete the INOPERABLE stack instance with either the CloudFormation console or AWS CLI.

CloudFormation console:

1.    Open the CloudFormation console.

2.    From the navigation pane, choose StackSets.

3.    From the StackSet name column, select the stack set that contains the instance that you want to delete.

4.    Choose Actions, and then choose Delete stacks from StackSets.

5.    On the Set deployment options page, for Account numbers, enter the 12-digit account number of the AWS account that's closed or suspended.

6.    In the Specify regions section, choose the AWS Region of your stack instance.

7.    In the Deployment options section, turn on Retain stacks, and then choose Next.

8.    On the Review page, choose Submit.

AWS CLI:

In the AWS CLI, run the following command:

$ aws cloudformation delete-stack-instances --stack-set-name YourStackSetName --accounts YourStackInstanceAccount --regions YourStackInstanceRegion --retain-stacks

Note: Replace YourStackSetName with the name of your stack set. Replace YourStackInstanceAccount with the AWS account number of the closed or suspended account. Replace YourStackInstanceRegion with the Region where the stack instance is located.

Delete inoperable stack instances for stack sets with service-managed permissions

For stack sets that use service-managed permissions, operations from the CloudFormation console can target only entire organizational units (OUs). You must use the AWS CLI to delete a specific stack instance from a single account.

In the AWS CLI, run the following command:

aws cloudformation delete-stack-instances --stack-set-name YourStackSetName --deployment-targets Accounts=YourStackInstanceAccount --regions YourStackInstanceRegion --retain-stacks

Note: Replace YourStackSetName with the name of your stack set. Replace YourStackInstanceAccount with the AWS account number of the closed or suspended account. Replace YourStackInstanceRegion with the Region where the stack instance is located.


Did this article help?


Do you need billing or technical support?