diff --git a/net/gce.sh b/net/gce.sh
index 4003e69a12..a051b02359 100755
--- a/net/gce.sh
+++ b/net/gce.sh
@@ -575,6 +575,14 @@ delete() {
   $metricsWriteDatapoint "testnet-deploy net-delete-complete=1"
 }
 
+create_error_cleanup() {
+  declare RC=$?
+  if [[ "$RC" -ne 0 ]]; then
+    delete
+  fi
+  exit $RC
+}
+
 case $command in
 delete)
   delete
@@ -587,6 +595,10 @@ create)
 
   $metricsWriteDatapoint "testnet-deploy net-create-begin=1"
 
+  if $failOnValidatorBootupFailure; then
+    trap create_error_cleanup EXIT
+  fi
+
   rm -rf "$sshPrivateKey"{,.pub}
 
   # Note: using rsa because |aws ec2 import-key-pair| seems to fail for ecdsa