Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 34b5ba5
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Prior to this change container secrets could be added to a JobDefinition this way:

db_secret = secretsmanager.Secret(self, "secret")

batch.JobDefinition(self, "batch-job-def-secrets",
    container=batch.JobDefinitionContainer(
        image=ecs.EcrImage.from_registry("docker/whalesay"),
        secrets={
            "PASSWORD": ecs.Secret.from_secrets_manager(db_secret, "password")
        }
    )
)

I suppose now the secrets need to be set via EcsEc2ContainerDefinitiont & co. I have tried a few things but have not found a way to do this. Could you please provide an example such as the one I quoted, for the new API?

Thanks for taking the new API for a spin! You should be able to do this now:

import * as cdk from 'aws-cdk-lib';
import * as secrets from 'aws-cdk-lib/aws-secretsmanager';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import { Construct } from 'constructs';
import * as batch from '@aws-cdk/aws-batch-alpha';

export class FooStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new batch.EcsJobDefinition(this, 'job', {
      container: new batch.EcsEc2ContainerDefinition(this, 'container', {
        cpu: 256,
        image: ecs.ContainerImage.fromRegistry('foo'),
        memory: cdk.Size.mebibytes(2048),
        secrets: [new secrets.Secret(this, 'mysecret')],
      }),
    });
  }
}

from aws_cdk import (
    Stack,
    aws_ecs as ecs,
    aws_secretsmanager as secrets,
    Size,
)
from constructs import Construct
from aws_cdk.aws_batch_alpha import EcsJobDefinition, EcsEc2ContainerDefinition

class FooPyStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        job_defn = EcsJobDefinition(self, "JobDefn",
            container=EcsEc2ContainerDefinition(self, "containerDefn",
            image=ecs.ContainerImage.from_registry("public.ecr.aws/amazonlinux/amazonlinux:latest"),
            memory=Size.mebibytes(2048),
            cpu=256,
            secrets=[secrets.Secret(self, 'Secret')]
        )
    )

Thanks. What I am not seeing in your example is the mapping from a secret to an environment variable set in the Docker container. In the example I quoted a secret is made available in the Docker container per environment variable PASSWORD.

How is the secret to be accessed in the Docker container with the new API?

I think this is the feature you're talking about: #20871

This is not supported in the new APIs, so I can add support for it; should just be changing the type from Secret[] to { [key: string]: Secret }