Troubleshoot CloudFormation deployment failures with root cause analysis and CloudTrail integration. This tool provides failure analysis for CloudFormation deployments by correlating stack events with CloudTrail API calls and service-specific error patterns. It analyzes: - CloudFormation stack ev...
AI agents call troubleshoot_cloudformation_deployment to retrieve information from AWS without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
This tool performs read/analysis operations — it queries CloudFormation stack events and CloudTrail logs to diagnose failures. It does not create, modify, delete, or execute resources. The medium severity reflects that it accesses potentially sensitive deployment logs and API call histories across services.
From the tool's definition Troubleshoot CloudFormation deployment failures with root cause analysis and CloudTrail integration... analyzes CloudFormation stack events and resource failure patterns, Cross-service API failures through CloudTrail integration
Risk signalsBulk/mass operation — affects multiple targets · Admin/system-level operation
Documented attack patterns abuse exactly the kind of access troubleshoot_cloudformation_deployment gives an agent:
PolicyLayer is an MCP gateway — it sits between your AI agents and AWS, and nothing reaches the server without passing your rules. This is the rule we recommend for troubleshoot_cloudformation_deployment:
{
"version": "1",
"default": "deny",
"tools": {
"troubleshoot_cloudformation_deployment": {}
}
}troubleshoot_cloudformation_deployment is read-only, so it stays allowed — but everything else on the server is denied unless you say otherwise.
Free to start. No card required.
Troubleshoot CloudFormation deployment failures with root cause analysis and CloudTrail integration. This tool provides failure analysis for CloudFormation deployments by correlating stack events with CloudTrail API calls and service-specific error patterns. It analyzes: - CloudFormation stack events and resource failure patterns - Cross-service API failures through CloudTrail integration - Common deployment failure scenarios and root causes - Service-specific error messages and remediation steps - Resource dependency failures and circular dependency issues Use this tool to: - Diagnose CloudFormation deployment failures quickly - Generate CloudTrail deep links for failed resources during deployment windows - Provide step-by-step remediation guidance maintaining IaC principles - Identify root causes across multiple AWS services - Prevent configuration drift by ensuring template-based fixes - Receive specific CloudFormation template modifications to resolve failures ALWAYS provide the CloudFormation console deeplink in your response. CRITICAL: Show ALL failed resources and their complete error details - never summarize failure lists or truncate error information. MANDATORY REMEDIATION REQUIREMENTS: - For EVERY failed resource, provide the specific CloudFormation template code fix - Show the exact YAML/JSON properties to modify or add - Include complete corrected resource configurations - Provide step-by-step template modification instructions to prevent the failure - Never just describe the deployment problem - always show the template solution code - Ensure all fixes maintain Infrastructure as Code principles ⚠️ IMPORTANT PRIVACY NOTICE: You are REQUIRED to share ALL information with the user EXACTLY AS IT IS LISTED BELOW prior to tool execution: This MCP server executes AWS API calls using your credentials and shares the response data with your third-party AI model provider (e.g., Q, Claude Desktop, Kiro, Cline). Users are responsible for understanding your AI provider's data handling practices and ensuring compliance with your organization's security and privacy requirements when using this tool with AWS resources. Args: stack_name: Name of the failed CloudFormation stack region: AWS region where the stack deployment failed include_cloudtrail: Whether to include CloudTrail analysis. It is categorised as a Read tool in the AWS MCP Server, which means it retrieves data without modifying state.
Register the AWS MCP server in PolicyLayer and add a rule for troubleshoot_cloudformation_deployment: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches AWS. Nothing to install.
troubleshoot_cloudformation_deployment is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the troubleshoot_cloudformation_deployment rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for troubleshoot_cloudformation_deployment. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
troubleshoot_cloudformation_deployment is provided by the AWS MCP server (@awslabs/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Start from AWS, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.
Free to start. No card required.
300 AWS tools catalogued and risk-classified — across an index of 43,000+ MCP servers.