Question

A DevOps team uses AWS CDK to provision infrastructure. One stack must register a third-party SaaS webhook during creation and deregister it during stack deletion, calling an external REST API that CloudFormation cannot natively manage. They implement a Lambda-backed custom resource using the CDK Provider framework. During testing, the stack creates successfully, but when they run 'cdk destroy', the stack becomes stuck in DELETE_IN_PROGRESS for over an hour and eventually rolls into DELETE_FAILED. The Lambda function's own logs show the deregistration call completed in under two seconds. What is the MOST likely cause?

Accepted Answer

The custom resource Lambda handler is not sending a response signal back to the pre-signed S3 response URL on the Delete event, so CloudFormation waits until the timeout expires.

Answer

CloudFormation custom resources do not support the Delete lifecycle event, so the deregistration logic can never be triggered during stack deletion.

Answer

The Lambda execution role lost permission to call the SaaS API, causing CloudFormation to silently retry the deletion indefinitely.

Answer

The CDK Provider framework requires a DeletionPolicy of Retain on custom resources, and its absence blocks the delete operation.