How do I remove StackSets from deleted or suspended accounts in AWS CloudFormation?
Last updated: 2020-06-22
I want to delete a stack instance from an AWS CloudFormation StackSet, but the deletion fails because the target AWS account is deleted or suspended.
You can't delete a stack instance that references a stack in a target account that's deleted or suspended. The delete operation fails, and the stack instance moves to the INOPERABLE status. The delete operation fails because AWSCloudFormationStackSetAdministrationRole is unable to assume the role AWSCloudFormationStackSetExecutionRole, which becomes unavailable when an account is deleted or suspended.
To delete the INOPERABLE stack instance, you must perform a DeleteStackInstances operation and set RetainStacks to true. This operation decouples the stack instance from the StackSet for any future operations.
Note: The following resolution applies only if the PermissionModel of the StackSet is set to SELF-MANAGED.
You can delete the INOPERABLE stack instance with either the AWS CloudFormation console or AWS Command Line Interface (AWS CLI).
AWS CloudFormation console
1. Open the AWS CloudFormation console.
2. From the navigation pane, choose StackSets.
3. From the StackSet name column, select the stack set that contains the instance that you want to delete.
4. Choose Actions, and then choose Delete stacks from StackSets.
5. On the Set deployment options page, for Account numbers, enter the 12-digit account number of the AWS account that's suspended or deleted.
6. In the Specify regions section, choose the AWS Region of your stack instance.
7. In the Deployment options section, turn on Retain stacks, and then choose Next.
8. On the Review page, choose Submit.
In the AWS CLI, run the delete-stack-instances command:
$ aws cloudformation delete-stack-instances --stack-set-name awsstacksetname123 --accounts stackinstanceaccount --regions stackinstanceregion --retain-stacks
Note: Replace awsstacksetname123 with the name of your StackSet. Replace stackinstanceaccount with the AWS account number of the deleted or suspended account. Replace stackinstanceregion with the Region where the stack instance is located.