Unable to delete cfn stack, role is invalid or cannot be assumed
Solution 1
I've had this problem a few times. The solution is a bit of a hack. In your case, you need to create a new role named CloudFormationRole-NestedCFN-CodePipeline
. When you create this role, you'll likely need to select the CloudFormation
service when it asks you to Choose the service that will use this role and then Attach permissions policies. Once the role is created, try to delete the stack again.
Some of this is a guessing game because you need to choose the correct resource (i.e. AWS service) that is a "trusted entity". Based on your role name, it's either CloudFormation or CodePipeline.
After you delete the CloudFormation stack, you can delete the IAM role you just created.
The reason you get this error is because you probably deleted a CloudFormation stack that has an IAM role that's being used by the stack you're trying to delete.
I wish there was a more elegant solution from AWS but this was my workaround.
Solution 2
I got the same problem and the only way to delete the stack was using the AWS CLI and executing the following command:
aws cloudformation delete-stack --role-arn arn:aws:iam::xxxx:role/anyrolewithpermissions --stack-name StuckStack
just be sure to use another role with enough permissions.
Solution 3
This usually happens when a role required to delete the stack has been accidentally deleted. You may get the error message
Role arn:aws:iam::<account>:role/<role name> is invalid or cannot be assumed
Go to IAM
> roles
> create role
> click on cloudformation
for the service > make sure you give it the right permissions
so that cloudformation can delete the stack. (In my case I gave it admin permissions because I was planning to delete the role straight after I deleted the stack > for Role name
use the same role name in the error message.
You should now be able to delete the stack
pelican
Updated on June 07, 2022Comments
-
pelican almost 2 years
I'm new to aws cloudformation; I'm wondering if anybody knows of a way to force delete a stack when it just won't delete. It fails with this error:
Failed to delete stack: Role arn:aws:iam::role/CloudFormationRole-NestedCFN-CodePipeline is invalid or cannot be assumed
This error usually happens when I try to delete a nested child stack instead of starting by deleting the parent stack first. Is there any way to delete the nested stack if I accidentally deleteted the parent stack?
-
pelican about 6 yearsThanks very much, the hack worked for me! The other suggested solutions below didn't quite work but thanks for helping me out everyone!
-
Milan Cermak about 5 yearsI would upvote this twice if I could. Helped me every time.
-
AHalbert almost 5 yearsThis helped me when creating the a role of the same name as the deleted role did not.
-
robscodebase almost 4 yearsThis helped me big time. I was trying to delete a nested stack but kept getting
role is invalid or cannot be assumed
even after creating new roles. I created a cloudformation-admin role with enough permissions to delete items in the stack and this command worked. Thanks. -
badfun about 3 yearsExcellent. Thank you. The 'official' method (aws.amazon.com/premiumsupport/knowledge-center/…) did not work for me. It's so hacky... hard to believe they documented it instead of coming up with a way to do this in the console.
-
Hom Bahrani about 3 yearsthanks, this is not a hack but a good solution. As you mentioned its most likely because the IAM role required to delete the stack has been accidentally deleted
-
Andy about 2 yearsthere is a slightly clearer article on the knowledge center now aws.amazon.com/premiumsupport/knowledge-center/…
-
user1751825 about 2 yearsThis was the only solution that worked for me.
-
Jonathan Heinen about 2 yearsSimple solution that works perfectly fine!
-
Alireza about 2 yearsMake sure to replace xxxx with your account id and anyrolewithpermission with a valid role with the required permission. If you don't know what permissions are required, just create a new temporary role with admin permissions.
-
Luan Pham almost 2 yearsFour years have passed, this is still the best solution!