Skip to main content

Teardown

Teardown happens in two distinct steps with very different consequences: deleting individual StackSets, and disabling the StackSets service for your organization. Disabling the service is blocked until every StackSet has been deleted.

Deleting a StackSet​

Deleting a StackSet opens a confirmation dialog where you choose what happens to the deployed stacks:

OptionWhat happens
Delete stacksEvery stack instance is deleted and the resources those stacks created are destroyed in each target account and region
Retain stacksThe stack instances are removed from the StackSet, but the deployed stacks and their resources keep running in each account
warning

Retain stacks does not stop billing. Retained stacks and the resources in them continue to run — and continue to incur AWS charges — in every account they were deployed to. They are simply no longer managed by this StackSet. If you want the resources gone, choose Delete stacks.

To confirm, you must type the StackSet's name into the dialog. A progress screen appears while the instances are removed, and the StackSet disappears from the list once deletion completes.

Disabling the StackSets Service​

Disabling the service removes the StackSets footprint that enablement created across your accounts. You control it from the Danger zone section at the bottom of the StackSets list page.

  1. Delete every StackSet first. The Disable StackSets button stays disabled while any StackSet still exists, so work through the deletions above until the list is empty.
  2. Click Disable StackSets. A confirmation dialog appears with an Also delete the template bucket checkbox.
  3. Confirm to disable the service.

What disabling does:

  • Role removal: Prism removes CKPrism-StackSetAdministrationRole from the administration account and CKPrism-StackSetExecutionRole from every onboarded account.
  • Template bucket: if you tick Also delete the template bucket, Prism deletes the ck-prism-cfn-<account-id>-<region> bucket. This option is only available when Prism created the bucket during enablement.
note

Disabling removes execution roles from every account through a provisioning fan-out. Like enablement, this fan-out is not resumable across a backend restart — if the backend restarts mid-disable, the affected accounts are marked failed and you retry them from the role-provisioning grid on the StackSets list page.