title: Cloudformation Object Lock Rollback fail fix summary: Fixing UPDATE_ROLLBACK_FAILED after incorrectly setting ObjectLockEnabled in a cloudformation template updatedAt: 1738290900000 #

I was attempting to set up ObjectLock on an S3 bucket in a cloudformation template but accidentally did the following:

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketName: MyBucket
    VersioningConfiguration:
      Status: Enabled
    ObjectLockConfiguration:
      ObjectLockEnabled: Enabled

I'd forgotten the very important second ObjectLockEnabled! ... ^[1]

The correct way to do this is:

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    VersioningConfiguration:
      Status: Enabled
    ObjectLockEnabled: true
    ObjectLockConfiguration:
      ObjectLockEnabled: Enabled

However, since I'd deployed the last one - my stack was now stuck in UPDATE_ROLLBACK_FAILED due to the following error:

Resource handler returned message: "Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "software.amazon.s3.bucket.ResourceModel.getObjectLockEnabled()" is null"

The fix was to do the rollback via CLI and ignore the bucket:

aws cloudformation continue-update-rollback --stack-name myStackName --resources-to-skip MyBucket

I'm only writing about this on my site since zero results came up when I searched for this error message specifically! I also really wish that --resources-to-skip was usable via the CloudFormation web UI.