Solve: Fixing Poisoned Dynamic References in CloudFormation

Solve: Fixing Poisoned Dynamic References in CloudFormation Problem A CloudFormation update fails due to a Secrets Manager dynamic reference that no longer resolves. Even after removing the reference from the template, CFN still attempts to evaluate the broken reference — blocking further updates and leaving the stack stuck. Clarifying the Issue Dynamic references like this: yaml !Sub '{{resolve:secretsmanager:${SecretArn}:SecretString:TOKEN:AWSCURRENT:VersionId}}' resolve at deployment planning time, not runtime. If the referenced VersionId is no longer valid for the given VersionStage (e.g., AWSCURRENT ), the stack update fails. The trap? Even if you remove the reference from your new template, CloudFormation still evaluates the old reference during update planning. So the same error occurs — again and again — and the stack appears unrecoverable. Before / After Snippet ❌ Before (Poisoned) yaml Resources: HelloWorldFunction: Type: AWS::Lambda::Fu...