How to fix CloudFormation DELETE_FAILED for IAM Roles?

DVA-C02 By islever Editorial Last updated Aug 31, 2026

Short answer

C Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource after deployment.

Question

A developer received the following error message during an AWS CloudFormation deployment: DELETE_FAILED (The following resource(s) failed to delete: [ASGInstanceRole12345678].) Which action should the developer take to resolve this error?

Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
Add a DependsOn attribute to the ASGInstanceRole12345678 resource in the CloudFormation template. Then delete the stack.
Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource after deployment. Correct Answer
Add a force parameter when calling CloudFormation with the role-arn of ASGInstanceRole12345678.

Key Takeaways

This question tests the ability to use DeletionPolicy: Retain to bypass resource deletion failures and unblock the stack removal process.

To resolve CloudFormation DELETE_FAILED errors for stuck resources like IAM roles, the community consensus is to apply a DeletionPolicy: Retain to the resource. This allows the stack deletion to complete, enabling the developer to manually clean up the orphaned resource afterward.

Common mistake: A common mistake is choosing to contact AWS Support (Option A), as developers often overlook the ability to retain resources and manually clean them up to unblock the stack deletion.

Expert Analysis

Why the Answer Is Correct

Option C is the correct action because when CloudFormation fails to delete a resource (often due to active dependencies or service constraints), the stack deletion halts. By modifying the template to set DeletionPolicy: Retain for the ASGInstanceRole12345678, CloudFormation skips the deletion of that specific resource, allowing the rest of the stack to be removed successfully. The developer can then manually resolve any dependencies and delete the role via the IAM console.

Why the Other Options Are Wrong

Option A is incorrect because contacting AWS Support is unnecessary for this common scenario; manual intervention via the console is the standard first step. Option B is incorrect because DependsOn controls creation order and implicit dependencies, not the physical deletion capability of a resource that is failing to delete. Option D is incorrect because the CloudFormation API does not provide a generic 'force' parameter that accepts a role ARN to forcibly delete a specific resource during stack operations.

Community Comment Notes

Community members confirm that manually deleting the IAM role after removing attached policies or instance profiles is the standard fix. One user explicitly validated the solution by providing the CloudFormation syntax DeletionPolicy: Retain, reinforcing that this is the intended method to handle the DELETE_FAILED state for IAM roles.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When encountering DELETE_FAILED errors, look for options involving DeletionPolicy: Retain or manual deletion. This allows you to bypass the automated failure and clean up the environment manually, which is a common pattern in AWS troubleshooting questions.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

cachac 👍 2 Answered C

Manually delete the ASGInstanceRole12345678 resource if it is no longer needed.
preachr 👍 1 Answered C

If you are unable to automatically resolve the issue through CloudFormation, you may need to manually delete the IAM role. Go to the IAM console, locate the role (ASGInstanceRole12345678), and manually delete any attached policies or instance profiles. Then, delete the role manually. After manually deleting the role, you can retry the stack deletion process in CloudFormation.
albert_kuo 👍 1 Answered C

Resources: ASGInstanceRole12345678: Type: AWS::IAM::Role DeletionPolicy: Retain

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide