Question

A DevOps team manages a networking CloudFormation stack that uses the Outputs section with the Export field to publish a VPC ID and subnet IDs. Several application stacks consume these values using Fn::ImportValue. During a planned refactor, the team attempts to update the networking stack to remove one of the exported subnet outputs, but the stack update fails. What is the reason for the failure, and how should the team proceed?

Accepted Answer

CloudFormation blocks removal or modification of an exported output while another stack imports it; the team must first update the consuming stacks to stop importing the value, then update the networking stack.

Answer

Exported outputs can only be changed by enabling termination protection on the networking stack first; the team should enable it and retry the update.

Answer

The update failed because exports are region-scoped; the team should recreate the export in every region before removing it from the networking stack.

Answer

CloudFormation requires a stack policy allowing 'Update:Delete' on the Outputs resource; the team should add the policy and rerun the update.