Deployment Manager: Resource state ambiguity during failed updates

Google Cloud Deployment Manager utilizes a declarative configuration to provision resources, relying on the dependsOn property to manage sequential dependencies. When a deployment update fails, the system generates error logs in Cloud Logging, but the resulting state of the infrastructure can vary based on the deployment policy.

There is uncertainty regarding the precise behavior of resources that were successfully provisioned before a subsequent dependency failed during an update. Specifically, it is unclear how the system distinguishes between resources that should be retained and those that should be considered orphans when a partial deployment occurs.

• Does the 'abandon' policy apply uniformly to all resources in a failed update, or only to the specific resource that triggered the error?
• How can the current state of interdependent resources be verified to ensure no orphaned assets remain after a FAILED status?