AWS CloudFormation Support
Fixing CloudFormation circular dependency errors.
"Circular dependency between resources" means two or more resources each need the other to exist first, so CloudFormation cannot pick an order. The loop is usually hidden in a security group, a role or a Lambda permission. We trace it and break it without changing behavior.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Template validation or deploy says circular dependency between resources
- Two security groups reference each other
- A Lambda, its role and a resource policy depend on each other
- Nested stacks or exports form a loop
- A CDK synth or deploy reports a cycle
What you get
- The corrected template with the loop explained
- Split security group and IAM resources where needed
- A change set preview before deployment
- Template conventions that avoid cycles
How we do it
A clear, safe process you can follow along with.
1. List the resources named in the error
The message lists the resources in the loop. We draw each arrow, whether from Ref, Fn::GetAtt, Fn::Sub or DependsOn, until we see which dependency closes the circle.
2. Fix the security group loop
The most common loop is two security groups each referencing the other inside their inline ingress rules. We move the rules out into separate AWS::EC2::SecurityGroupIngress resources, which can be created after both groups exist.
3. Fix IAM and Lambda loops
A role whose policy references the Lambda ARN while the Lambda references the role is circular. We build the ARN by name with Fn::Sub or a pseudo-parameter pattern instead of GetAtt, or attach the permission as a separate resource.
4. Remove unnecessary DependsOn
An explicit DependsOn that duplicates or reverses an implicit order can create the loop. We delete those that add nothing.
5. Handle cross-stack and nested loops
Stack A exporting to B while B exports to A cannot work. We move the shared piece to a third stack or pass values as parameters.
6. Validate and deploy safely
We validate the template, preview with a change set and deploy to a test stack first. In CDK we use the synthesized template and the construct tree to find the cross-reference that creates the cycle.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Adding DependsOn to fix a cycle
It adds edges. Cycles are fixed by removing edges.
Inline security group rules referencing each other
Use standalone ingress and egress resources.
Hard-coding ARNs without thinking
Constructed names must still match the real resource names exactly.
Ignoring the CDK construct tree
Calls like grant or addDependency can add hidden edges.
Frequently Asked Questions
What causes "Circular dependency between resources"?
Two or more resources depend on each other through Ref, GetAtt or DependsOn, so no creation order exists. Common cases are mutually referencing security groups and IAM and Lambda references.
How do I fix circular dependency in security groups?
Define the ingress rules as separate SecurityGroupIngress resources, so each group exists before the rule that points to the other.
Does CDK avoid circular dependencies?
No. CDK generates the CloudFormation template, and grants or cross-references between constructs can still create cycles, which need to be restructured.
Want Help With Fixing CloudFormation circular dependency errors?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required