# delstack: A CLI that actually removes CloudFormation stacks stuck on undeletable resources

> delstack is a Go-based CLI for deleting AWS CloudFormation and CDK stacks, including force-deleting resources that normally block deletion. It handles dependency ordering, parallel deletion, and CDK synthesis, but you should verify its resource coverage against your stack before relying on it.

**go-to-k/delstack** — A CLI tool for deleting AWS CloudFormation and AWS CDK stacks, from routine deletions to force deleting stacks with undeletable resources.

- Repository: https://github.com/go-to-k/delstack
- Website: https://dev.to/aws-heroes/zero-orphaned-resources-force-deleting-any-cloudformation-stack-3b1h
- Stars: 96 · Forks: 3
- Language: Go
- License: MIT
- Published: 2026-08-26 · Updated: 2026-08-26 · Language: en
- Canonical page: https://hysenlabs.com/projects/go-to-k-delstack

## The orphaned resource problem delstack targets

The README claims that delstack handles everything from routine deletions to stacks with undeletable resources. That is a wide promise. The force-delete table lists a specific set of resource types, not all AWS resources. So the claim is accurate only for the listed types. For any other resource that fails deletion, delstack will likely behave like normal CloudFormation deletion and fail. That boundary matters. You should not assume delstack can force-delete any arbitrary resource. It is a targeted tool, not a universal sledgehammer.

## How delstack deletes: parallel execution with dependency resolution

For CDK stacks, delstack cdk synthesizes the app first. It runs npx cdk synth unless you supply an existing cdk.out directory with -a. After synthesis, it discovers all stacks, including cross-region ones, and deletes them with the same dependency resolution. This is useful for tearing down an entire CDK application. The -c option passes context values to the synth command, so you can control environment-specific settings. The -a option skips synthesis entirely, which is faster if you already have a cdk.out from a previous deploy. The README warns that the AWS CDK CLI must be installed unless you use -a. That is a concrete requirement. If you are on a machine without Node.js or the CDK CLI, the cdk subcommand will not work without a pre-generated cdk.out.

## Getting delstack running: install and basic commands

The CDK subcommand follows a similar pattern. delstack cdk -s MyStack deletes a specific stack after synthesis. delstack cdk -a ./cdk.out skips synthesis and reads the manifest directly. delstack cdk -c env=dev passes context to the synth step. The -f and -y flags work the same way. One limitation is that the README does not show how to specify a region for the cdk subcommand, though the global -r flag is listed as working. That is a minor documentation gap.

## Force deletion mechanics: what delstack actually cleans up

One trade-off is that force mode with -f is a blunt instrument. It disables TerminationProtection on stacks and resource-level protection on EC2, RDS, and Cognito. It also overrides Retain deletion policies. That is a destructive action. The -y flag skips confirmation prompts, so you could run delstack -f -y and delete a stack with protected resources without any further warning. The README does not mention any dry-run mode. There is no --dry-run flag listed. That is a genuine limitation. If you want to see what delstack would do before doing it, the README does not offer that option. You have to rely on the confirmation prompts, which -y bypasses.

## Limitations and failure modes to consider before adoption

The CDK integration requires the CDK CLI unless you use -a. That is a real constraint. In a CI environment where you only have the compiled cdk.out artifact, -a works. But if you want to synthesize fresh, you need Node.js and the CDK CLI installed. The README does not mention any version requirements for the CDK CLI or Go. The install script pipes from the internet, which is a security consideration. You should review the script before running it, especially in a corporate environment.

## Alternatives and how they differ in approach

A third alternative is to write your own cleanup scripts using the AWS CLI. You could manually empty S3 buckets, detach IAM policies, and delete ECR images before calling delete-stack. That approach is flexible but time-consuming and error-prone. delstack packages these cleanup steps into a single command. The trade-off is that you rely on delstack's list of supported resources. With your own scripts, you can handle any resource type, but you have to maintain them. The README does not compare itself to any tool, so this assessment is based on the features described.

## Maintenance and license implications

The Go implementation means the binary is a single static executable, which is easy to distribute. The README does not mention any telemetry or external calls beyond AWS APIs. That is a privacy positive. But the install script fetches from the internet, so you should verify checksums if you are security-conscious. The README does not provide checksums for the install script, which is a gap.

## Conclusion

Adopt delstack if you routinely delete CloudFormation or CDK stacks and have hit DELETE_FAILED on S3 buckets, IAM users, ECR repositories, or similar resources. Avoid it if you need guaranteed support for every AWS resource type or if you cannot install a third-party binary in your environment. Before using it in production, verify that the resource types in your stacks are listed in the README's force-delete table, and test with -n 1 on a non-critical stack to confirm the dependency resolution behaves as expected.

## FAQ

### How do I delete a CloudFormation stack with delstack?

Name it with -s, optionally with -p for an AWS profile and -r for a region, which defaults to us-east-1. Several stacks can be named at once and are deleted in parallel by default with inter-stack dependencies respected, and -n caps the concurrency. With -i you pick the stack from a TUI instead, and -f forces deletion past Retain policies, deletion protection and TerminationProtection.

### How do I delete a CDK stack with delstack?

Run the cdk subcommand in your CDK app directory. It synthesizes with npx cdk synth, discovers every stack including cross-region ones, and deletes them with dependency resolution. Pass -a to point at an existing cdk.out and skip synthesis, and -c key=value to pass CDK context, which requires the AWS CDK CLI unless -a is used.

### Which resource types can delstack force delete?

S3 buckets including non-empty or versioned ones, S3 Express directory buckets, S3 Tables table buckets and namespaces, S3 Vectors buckets, ECR repositories whose EmptyOnDelete is not true, Backup vaults, and IAM roles, groups and users that have dependencies from outside the stack. Every other resource is deleted normally.

### How do I install delstack?

From the go-to-k Homebrew tap, from the install.sh script on Linux, macOS and Windows, through aqua, through mise, from a prebuilt binary in Releases, or with make install after cloning. The script takes a version argument, so sh -s "v1.2.0" pins a specific release.

### Does delstack work with stacks that are not plain CloudFormation?

Yes. It works with stacks deployed by AWS CDK, AWS SAM, AWS Amplify, the Serverless Framework, and any infrastructure as code tool that deploys through CloudFormation, since it operates on the CloudFormation API rather than on a template format.

## Sources

- [Official documentation](https://dev.to/aws-heroes/zero-orphaned-resources-force-deleting-any-cloudformation-stack-3b1h)
- [Official README](https://github.com/go-to-k/delstack#readme)
- [Project repository](https://github.com/go-to-k/delstack)
- [Release notes](https://github.com/go-to-k/delstack/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/go-to-k-delstack