# troubleshoot_cloudformation_deployment

Troubleshoot CloudFormation deployment failures with root cause analysis and CloudTrail integration. This tool provides failure analysis for CloudFormation deployments by correlating stack events with CloudTrail API calls and service-specific error patterns. It analyzes: - CloudFormation stack events and resource failure patterns - Cross-service API failures through CloudTrail integration - Common deployment failure scenarios and root causes - Service-specific error messages and remediation steps - Resource dependency failures and circular dependency issues Use this tool to: - Diagnose CloudFormation deployment failures quickly - Generate CloudTrail deep links for failed resources during deployment windows - Provide step-by-step remediation guidance maintaining IaC principles - Identify root causes across multiple AWS services - Prevent configuration drift by ensuring template-based fixes - Receive specific CloudFormation template modifications to resolve failures ALWAYS provide the CloudFormation console deeplink in your response. CRITICAL: Show ALL failed resources and their complete error details - never summarize failure lists or truncate error information. MANDATORY REMEDIATION REQUIREMENTS: - For EVERY failed resource, provide the specific CloudFormation template code fix - Show the exact YAML/JSON properties to modify or add - Include complete corrected resource configurations - Provide step-by-step template modification instructions to prevent the failure - Never just describe the deployment problem - always show the template solution code - Ensure all fixes maintain Infrastructure as Code principles ⚠️ IMPORTANT PRIVACY NOTICE: You are REQUIRED to share ALL information with the user EXACTLY AS IT IS LISTED BELOW prior to tool execution: This MCP server executes AWS API calls using your credentials and shares the response data with your third-party AI model provider (e.g., Q, Claude Desktop, Kiro, Cline). Users are responsible for understanding your AI provider's data handling practices and ensuring compliance with your organization's security and privacy requirements when using this tool with AWS resources. Args: stack_name: Name of the failed CloudFormation stack region: AWS region where the stack deployment failed include_cloudtrail: Whether to include CloudTrail analysis

Agent View of the PolicyLayer registry record for `troubleshoot_cloudformation_deployment`. HTML page: https://policylayer.com/tools/aws/troubleshoot-cloudformation-deployment

## Facts

- Tool: `troubleshoot_cloudformation_deployment`
- Server: AWS (`@awslabs/mcp`) — https://policylayer.com/tools/aws.md
- Install: `npx -y @awslabs/mcp`
- Homepage: https://github.com/awslabs/mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity verified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "troubleshoot_cloudformation_deployment",
    "arguments": {}
  }
}
```

## Why troubleshoot_cloudformation_deployment is rated Low

This tool performs read/analysis operations — it queries CloudFormation stack events and CloudTrail logs to diagnose failures. It does not create, modify, delete, or execute resources. The medium severity reflects that it accesses potentially sensitive deployment logs and API call histories across services.

From the tool's own definition: "Troubleshoot CloudFormation deployment failures with root cause analysis and CloudTrail integration... analyzes CloudFormation stack events and resource failure patterns, Cross-service API failures through CloudTrail integration"

Risk signals: Bulk/mass operation — affects multiple targets · Admin/system-level operation

## Use case

AI agents call troubleshoot_cloudformation_deployment to retrieve information from AWS without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches AWS:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "troubleshoot_cloudformation_deployment": {}
  }
}
```

## Other tools on AWS (299)

- `bulk_delete_by_criteria` — Destructive — https://policylayer.com/tools/aws/bulk-delete-by-criteria.md
- `cache_delete` — Destructive — https://policylayer.com/tools/aws/cache-delete.md
- `cache_delete_many` — Destructive — https://policylayer.com/tools/aws/cache-delete-many.md
- `cache_delete_multi` — Destructive — https://policylayer.com/tools/aws/cache-delete-multi.md
- `cache_flush_all` — Destructive — https://policylayer.com/tools/aws/cache-flush-all.md
- `delete` — Destructive — https://policylayer.com/tools/aws/delete.md
- `delete_access_key` — Destructive — https://policylayer.com/tools/aws/delete-access-key.md
- `delete_datastore` — Destructive — https://policylayer.com/tools/aws/delete-datastore.md
- `delete_group` — Destructive — https://policylayer.com/tools/aws/delete-group.md
- `delete_image_set` — Destructive — https://policylayer.com/tools/aws/delete-image-set.md
- `delete_instance_in_series` — Destructive — https://policylayer.com/tools/aws/delete-instance-in-series.md
- `delete_instance_in_study` — Destructive — https://policylayer.com/tools/aws/delete-instance-in-study.md
- `delete_patient_studies` — Destructive — https://policylayer.com/tools/aws/delete-patient-studies.md
- `delete_resource` — Destructive — https://policylayer.com/tools/aws/delete-resource.md
- `delete_role_policy` — Destructive — https://policylayer.com/tools/aws/delete-role-policy.md
- `delete_series_by_uid` — Destructive — https://policylayer.com/tools/aws/delete-series-by-uid.md
- `delete_study` — Destructive — https://policylayer.com/tools/aws/delete-study.md
- `delete_user` — Destructive — https://policylayer.com/tools/aws/delete-user.md
- `delete_user_policy` — Destructive — https://policylayer.com/tools/aws/delete-user-policy.md
- `detach_user_policy` — Destructive — https://policylayer.com/tools/aws/detach-user-policy.md
- `json_arrtrim` — Destructive — https://policylayer.com/tools/aws/json-arrtrim.md
- `json_clear` — Destructive — https://policylayer.com/tools/aws/json-clear.md
- `json_del` — Destructive — https://policylayer.com/tools/aws/json-del.md
- `list_pop_left` — Destructive — https://policylayer.com/tools/aws/list-pop-left.md
- `list_trim` — Destructive — https://policylayer.com/tools/aws/list-trim.md
- `remove_instance_from_image_set` — Destructive — https://policylayer.com/tools/aws/remove-instance-from-image-set.md
- `remove_series_from_image_set` — Destructive — https://policylayer.com/tools/aws/remove-series-from-image-set.md
- `set_pop` — Destructive — https://policylayer.com/tools/aws/set-pop.md
- `sorted_set_remove_by_lex` — Destructive — https://policylayer.com/tools/aws/sorted-set-remove-by-lex.md
- `sorted_set_remove_by_score` — Destructive — https://policylayer.com/tools/aws/sorted-set-remove-by-score.md
- …and 269 more: https://policylayer.com/tools/aws.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=aws · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/aws