AWS SAM "Failed to create/update the stack" - Fix Deploy in CI

sam deploy handed your template to CloudFormation and CloudFormation rejected or rolled it back. The real cause is a resource-level failure in the change set, not SAM itself.

What this error means

sam deploy runs, creates a change set, then fails with Failed to create/update the stack. The per-resource reason is in the CloudFormation events - an IAM denial, a name collision, or a stack stuck in ROLLBACK_COMPLETE that cannot be updated.

Error: Failed to create/update the stack: my-api, Waiter StackCreateComplete
failed: Waiter encountered a terminal failure state: For expression "Stacks[].StackStatus"
we matched expected path: "ROLLBACK_COMPLETE"

Common causes

A resource in the template failed to create

CloudFormation rolls the whole stack back if any resource errors - an IAM permission gap, a duplicate physical name, or an invalid property. SAM surfaces only the top-level failure.

Stack stuck in ROLLBACK_COMPLETE

A first-ever create that failed leaves the stack in ROLLBACK_COMPLETE, which cannot be updated - it must be deleted before a fresh deploy.

How to fix it

Read the failing CloudFormation event

Find the first resource failure - that is the real error.

aws cloudformation describe-stack-events --stack-name my-api \
  --query "StackEvents[?ResourceStatus=='CREATE_FAILED'].[LogicalResourceId,ResourceStatusReason]" \
  --output table

Delete a ROLLBACK_COMPLETE stack and redeploy

A stack in ROLLBACK_COMPLETE from a failed first create cannot be updated; delete it, then deploy again.

aws cloudformation delete-stack --stack-name my-api
aws cloudformation wait stack-delete-complete --stack-name my-api
sam deploy --no-confirm-changeset

How to prevent it

• Grant the deploy role the IAM permissions every templated resource needs.
• Use sam validate and a change-set review in PR checks before deploy.
• Avoid hard-coded physical names that collide across environments.

Related guides