AWS Batch CDK: How to pass container secrets?

Question

AWS CDK [released a breaking change](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md#2740-2023-04-13) last week that affects users of the `aws_batch_alpha` module. Previous to that change the module allowed passing secrets to containers [as follows](https://pypi.org/project/aws-cdk.aws-batch-alpha/2.73.0a0/#job-definition):

```
db_secret = secretsmanager.Secret(self, "secret")

batch.JobDefinition(self, "batch-job-def-secrets",
    container=batch.JobDefinitionContainer(
        image=ecs.EcrImage.from_registry("docker/whalesay"),
        secrets={
            "PASSWORD": ecs.Secret.from_secrets_manager(db_secret, "password")
        }
    )
)
```
This no longer works. I suppose now secrets need to be set via [`EcsEc2ContainerDefinition`](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_batch_alpha/EcsEc2ContainerDefinition.html) & co. I have tried a few things but have not found a way to do what the example above does. Could some provide an example that works with the new AWS Batch CDK API?

Wayne_G · Answer

It looks like the primary change here was to split the resource types into separate ECS and EKS types.

So, instead of `batch.JobDefinition`, there's `batch.EcsJobDefinition` [1], along with `batch.MultiNodeJobDefinition` [2], as well as an EKS equivalent. Either of these types will accept a `container` parameter of the type `batch.EcsEc2ContainerDefinition` [3]. In turn, the container definition will accept a `secrets` parameter [4], which should work with the same `ecs.Secret.from_secrets_manager` call you currently have.

Keep in mind that this is untested, but I believe your code should look something like this:
```
db_secret = secretsmanager.Secret(self, "secret")

batch.EcsJobDefinition(self, "batch-job-def-secrets",
    container=batch.EcsEc2ContainerDefinition(
        image=ecs.EcrImage.from_registry("docker/whalesay"),
        secrets={
            "PASSWORD": ecs.Secret.from_secrets_manager(db_secret, "password")
        }
    )
)
```
There may be some additional minor changes needed that I'm overlooking, but it does look like these new types mostly align with the previous ones for what parameters they expect. Overall though, it looks to me like a matter of simply using `EcsJobDefinition` in place of `JobDefinition`, and `EcsEc2ContainerDefinition` in place of `JobDefinitionContainer`.

[1] https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_batch_alpha/EcsJobDefinition.html
[2] https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_batch_alpha/MultiNodeJobDefinition.html
[3] https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_batch_alpha/EcsEc2ContainerDefinition.html
[4] https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_secretsmanager/ISecret.html

AWS Batch CDK: How to pass container secrets?

Relevant content