aws_batch: cannot set compute_resources in ComputeEnvironment

[ghost]

This code snippet works fine in aws_cdk:1.26 in python:

 compute_resource = batch.ComputeResources(
	 vpc=vpc,
	 vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),
	 minv_cpus=0,
	 desiredv_cpus=1,
	 maxv_cpus=2,
	 instance_types=[ec2.InstanceType.of(ec2.InstanceClass.STANDARD5_NVME_DRIVE,ec2.InstanceSize.LARGE)],
	 instance_role=iam.Role.from_role_arn(self,
			 "ecsInstanceRole",
			 role_arn=f"arn:aws:iam::{scope.account}:instance-profile/ecsInstanceRole"),
			 )
compute_env = batch.ComputeEnvironment(self,
       f"{self.stack_name}_ComputeEnv",
       managed=False,
       compute_resources=compute_resource) #--->  **I get error in aws_cdk:1.30 in this line**

But when I update aws_cdk to 1.30 I get the following error:

jsii.errors.JSIIError: Expected a string, got {"$jsii.byref":"@aws-cdk/core.Resource@10068"}

and the problem is on compute_resources=compute_resource line.

[iliapolo]

Hi @MostafaFarzane

The problem actually comes from the fact you are passing an iam.Role object to the instance_role property, that now expects a string.

instance_role=iam.Role.from_role_arn(self, 
    "ecsInstanceRole", 
    role_arn=f"arn:aws:iam::{scope.account}:instance-profile/ecsInstanceRole")

This was indeed changed in version 1.28.0.

You can have a look at the instance_role property documentation here.

So instead, simply change to:

# also notice i changed `scope.account` to `self.account` since the `account` attribute exists in the `Stack` object, not the `Construct`.
instance_role=f"arn:aws:iam::{self.account}:instance-profile/ecsInstanceRole" 

These types of problems are common when using dynamic languages like python. We actually have an issue on our plate to add dynamic type validation to mimic the behavior of static languages (where this would fail at compile time).

You are welcome to track it here: aws/jsii#1321

Also, I noticed you use managed=False. Actually, compute resources can only be used for managed compute environments, the fact this worked for you before was actually because of a bug. So, you should use managed=True, otherwise you'll get a validation error during synth:

jsii.errors.JavaScriptError:
  Error: It is not allowed to set computeResources on an AWS unmanaged compute environment
      at ComputeEnvironment.validateProps (/private/var/folders/mb/5zx1h88x2891nhk4qpr6_zc8jcqzm6/T/jsii-kernel-7dNSLl/node_modules/@aws-cdk/aws-batch/lib/compute-environment.js:146:19)
      at new ComputeEnvironment (/private/var/folders/mb/5zx1h88x2891nhk4qpr6_zc8jcqzm6/T/jsii-kernel-7dNSLl/node_modules/@aws-cdk/aws-batch/lib/compute-environment.js:57:14)
      at obj._wrapSandboxCode (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7838:49)
      at Kernel._wrapSandboxCode (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:8301:19)
      at Kernel._create (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7838:26)
      at Kernel.create (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7585:21)
      at KernelHost.processRequest (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7372:28)
      at KernelHost.run (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7312:14)
      at Immediate.setImmediate [as _onImmediate] (/private/tmp/triage-6850/.env/lib/python3.6/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7315:37)
      at runCallback (timers.js:705:18)
      at tryOnImmediate (timers.js:676:5)
      at processImmediate (timers.js:658:5)

More details about the bug that caused this and the fix can be found here: #6549

[ghost]

@iliapolo Thanks for the response.
With applying the changes you mentioned, now it is working.