[Batch] Add "Secrets" properties in interface JobDefinitionContainer

[Cloudrage]

Use Case

Need to pass Secrets to a Batch Job with CDK Batch Construct.
Not available yet :
https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-batch.JobDefinitionContainer.html

Proposed Solution

Like with CloudFormation, it'll be interesting to add "Secrets" propertie to the CDK Batch Construct :
https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-batch.CfnJobDefinition.ContainerPropertiesProperty.html#secrets

Other

https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-batch.CfnJobDefinition.SecretProperty.html

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[iliapolo]

@Cloudrage Thanks for this. Added.

Just making sure you are aware of escape hatches to unblock yourself in the meantime.

[Cloudrage]

Yep, it's what I'm doing when pasting links about that workaround previously; thanks !

Also, maybe think about an "addSecrets" Method for the Batch Job.

[daniel-j-h]

The workaround I came up with looks something like this

// Secrets are not yet supported in the high-level JobDefinition
//  - https://github.com/aws/aws-cdk/issues/10976
//  - https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-batch.CfnJobDefinition.ContainerPropertiesProperty.html#secrets
const cfnJobDef = jobDef.node.defaultChild as CfnJobDefinition;
const cfnContainerProps = cfnJobDef.containerProperties as CfnJobDefinition.ContainerPropertiesProperty;

(cfnContainerProps as any).secrets = [  // cast to any needed because .secrets property is readonly
  { name: "MY_SECRET", valueFrom: mySecretArn },
];

in case folks are stumbling over this issue.

[hughack]

For anyone else struggling to figure it out, the equivalent for Python is:

my_job_definition.node.default_child.add_property_override("ContainerProperties.Secrets", [
    {
        "Name": "SOME_ENV_VAR",
        "ValueFrom": f"{my_secret.secret_arn}:some_key::"
    }
])

In my case my_secret obtained using:

my_secret = secrets_manager.Secret.from_secret_name_v2(
    self,
    "MySecret",
    "secret-name-in-secret-manager"
)

And the secret itself being a json object, where i only want some_key to be used in SOME_ENV_VAR.

[AndreyMarchuk]

JobDefinitionContainer would require defined execution_role when using Secrets Manager

Python

1. Create execution role

batch_execution_role = iam.Role(self, "batchExecRole", 
                assumed_by=iam.ServicePrincipal('ecs-tasks.amazonaws.com'), 
                managed_policies=[iam.ManagedPolicy.from_aws_managed_policy_name('service-role/AmazonECSTaskExecutionRolePolicy')])

2. Set on execution_role=batch_execution_role on JobDefinitionContainer level

3. Grant secret read permissions

my_secret.grant_read(batch_execution_role)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.