CloudFormation Stack Failure: Custom::CreateWorkspace in CREATE_FAILED State

[Vanamaajay]

I am trying to create a workspace using AWS CloudFormation, but the stack fails with the following error:

"The resource CreateWorkspace is in a CREATE_FAILED state. This Custom::CreateWorkspace resource is in a CREATE_FAILED state. Received response status [FAILED] from custom resource."

How can I resolve this issue? Any insights would be greatly appreciated.

[mark_ott]

When a CloudFormation stack fails with “The resource CreateWorkspace is in a CREATE_FAILED state” for a Custom::CreateWorkspace resource, it typically means the Lambda or service backing the custom resource returned a FAILED signal to CloudFormation or failed to send a success signal in time. Most commonly, this is due to issues inside the Lambda function, misconfiguration, or permission problems.

Common Root Causes

• The Lambda (or other backing service) failed due to an error (exception, misconfiguration, missing environment variables, etc.).​

• The Lambda does not have the correct permissions (IAM policy issues) to perform its intended action, such as logging to CloudWatch (important for debugging).​

• The Lambda does not signal completion correctly to CloudFormation (it must send a response with status SUCCESS or FAILED to a presigned S3 URL, usually using the cfn-response module or equivalent).​

• The resource is attempting to create something that already exists, or there is a naming/resource conflict in the environment.​

• Resource limits are exceeded, or required resources (like subnets, security groups, VPCs, or IAM roles) are missing or improperly referenced.​

• If the Lambda runs out of memory or times out, CloudFormation will mark the custom resource as failed.​

How to Troubleshoot and Resolve

• Review the CloudFormation Events tab in the AWS Console for error details and timestamps.

• Check the Lambda function’s logs in CloudWatch for traceback, error messages, or missing permissions.

• Confirm the Lambda function’s IAM role includes sufficient permissions for all AWS service actions it attempts, and permissions to write logs to CloudWatch.​

• Ensure that the Lambda or backing service sends the CloudFormation Response using the correct format and destination URL (using the cfn-response library or similar mechanism).​

• If using a third-party or partner template (such as Databricks workspaces), consult vendor-specific documentation and ensure any required prerequisites (network, resource quotas, subscriptions) are set up.​

• Optionally, use the AWSSupport-TroubleshootCFNCustomResource runbook in AWS Systems Manager to analyze stack and custom resource errors efficiently.​