CloudFormation Stack Failure: Custom::CreateWorkspace in CREATE_FAILED State

Vanamaajay
New Contributor

‎02-13-2025 09:42 PM

I am trying to create a workspace using AWS CloudFormation, but the stack fails with the following error:

"The resource CreateWorkspace is in a CREATE_FAILED state. This Custom::CreateWorkspace resource is in a CREATE_FAILED state. Received response status [FAILED] from custom resource."

How can I resolve this issue? Any insights would be greatly appreciated.

0 Kudos

mark_ott
Databricks Employee
Databricks Employee

‎11-12-2025 09:00 AM

When a CloudFormation stack fails with “The resource CreateWorkspace is in a CREATE_FAILED state” for a Custom::CreateWorkspace resource, it typically means the Lambda or service backing the custom resource returned a FAILED signal to CloudFormation or failed to send a success signal in time. Most commonly, this is due to issues inside the Lambda function, misconfiguration, or permission problems.

Common Root Causes

  • The Lambda (or other backing service) failed due to an error (exception, misconfiguration, missing environment variables, etc.).​

  • The Lambda does not have the correct permissions (IAM policy issues) to perform its intended action, such as logging to CloudWatch (important for debugging).​

  • The Lambda does not signal completion correctly to CloudFormation (it must send a response with status SUCCESS or FAILED to a presigned S3 URL, usually using the cfn-response module or equivalent).​

  • The resource is attempting to create something that already exists, or there is a naming/resource conflict in the environment.​

  • Resource limits are exceeded, or required resources (like subnets, security groups, VPCs, or IAM roles) are missing or improperly referenced.​

  • If the Lambda runs out of memory or times out, CloudFormation will mark the custom resource as failed.​

How to Troubleshoot and Resolve

  • Review the CloudFormation Events tab in the AWS Console for error details and timestamps.

  • Check the Lambda function’s logs in CloudWatch for traceback, error messages, or missing permissions.

  • Confirm the Lambda function’s IAM role includes sufficient permissions for all AWS service actions it attempts, and permissions to write logs to CloudWatch.​

  • Ensure that the Lambda or backing service sends the CloudFormation Response using the correct format and destination URL (using the cfn-response library or similar mechanism).​

  • If using a third-party or partner template (such as Databricks workspaces), consult vendor-specific documentation and ensure any required prerequisites (network, resource quotas, subscriptions) are set up.​

  • Optionally, use the AWSSupport-TroubleshootCFNCustomResource runbook in AWS Systems Manager to analyze stack and custom resource errors efficiently.​

0 Kudos