diff --git a/packages/@aws-cdk/aws-batch/README.md b/packages/@aws-cdk/aws-batch/README.md
index 8c06ad6e7b623..082e29af446e6 100644
--- a/packages/@aws-cdk/aws-batch/README.md
+++ b/packages/@aws-cdk/aws-batch/README.md
@@ -187,6 +187,43 @@ const myComputeEnv = new batch.ComputeEnvironment(this, 'ComputeEnv', {
 });
 ```
 
+Note that if your launch template explicitly specifies network interfaces,
+for example to use an Elastic Fabric Adapter, you must use those security groups rather
+than allow the `ComputeEnvironment` to define them.  This is done by setting
+`useNetworkInterfaceSecurityGroups` in the launch template property of the environment.
+For example:
+
+```ts
+declare const vpc: ec2.Vpc;
+
+const efaSecurityGroup = new ec2.SecurityGroup(this, 'EFASecurityGroup', {
+  vpc,
+});
+
+const launchTemplateEFA = new ec2.CfnLaunchTemplate(this, 'LaunchTemplate', {
+  launchTemplateName: 'LaunchTemplateName',
+  launchTemplateData: {
+    networkInterfaces: [{
+      deviceIndex: 0,
+      subnetId: vpc.privateSubnets[0].subnetId,
+      interfaceType: 'efa',
+      groups: [efaSecurityGroup.securityGroupId],
+    }],
+  },
+});
+
+const computeEnvironmentEFA = new batch.ComputeEnvironment(this, 'EFAComputeEnv', {
+  managed: true,
+  computeResources: {
+    vpc,
+    launchTemplate: {
+      launchTemplateName: launchTemplateEFA.launchTemplateName as string,
+      useNetworkInterfaceSecurityGroups: true,
+    },
+  },
+});
+```
+
 ### Importing an existing Compute Environment
 
 To import an existing batch compute environment, call `ComputeEnvironment.fromComputeEnvironmentArn()`.
diff --git a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts
index 5e3b954bef541..557eabd3ce4fe 100644
--- a/packages/@aws-cdk/aws-batch/lib/compute-environment.ts
+++ b/packages/@aws-cdk/aws-batch/lib/compute-environment.ts
@@ -83,6 +83,19 @@ export interface LaunchTemplateSpecification {
    * @default - the default version of the launch template
    */
   readonly version?: string;
+  /**
+   * Use security groups defined in the launch template network interfaces
+   *
+   * In some cases, such as specifying Elastic Fabric Adapters,
+   * network interfaces must be used to specify security groups.  This
+   * parameter tells the Compute Environment construct that this is your
+   * intention, and stops it from creating its own security groups.  This
+   * parameter is mutually exclusive with securityGroups in the Compute
+   * Environment
+   *
+   * @default - false
+   */
+  readonly useNetworkInterfaceSecurityGroups?: boolean;
 }
 
 /**
@@ -138,9 +151,11 @@ export interface ComputeResources {
   readonly instanceTypes?: ec2.InstanceType[];
 
   /**
-   * The EC2 security group(s) associated with instances launched in the compute environment.
+   * Up to 5 EC2 security group(s) associated with instances launched in the compute environment.
+   *
+   * This parameter is mutually exclusive with launchTemplate.useNetworkInterfaceSecurityGroups
    *
-   * @default - AWS default security group.
+   * @default - Create a single default security group.
    */
   readonly securityGroups?: ec2.ISecurityGroup[];
 
@@ -375,7 +390,9 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment,
     const spotFleetRole = this.getSpotFleetRole(props);
     let computeResources: CfnComputeEnvironment.ComputeResourcesProperty | undefined;
 
-    this.connections = this.buildConnections(props.computeResources?.vpc, props.computeResources?.securityGroups);
+    const useLaunchTemplateNetworkInterface = props.computeResources?.launchTemplate?.useNetworkInterfaceSecurityGroups ? true : false;
+
+    this.connections = this.buildConnections(useLaunchTemplateNetworkInterface, props.computeResources?.vpc, props.computeResources?.securityGroups);
 
     // Only allow compute resources to be set when using MANAGED type
     if (props.computeResources && this.isManaged(props)) {
@@ -388,7 +405,7 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment,
         launchTemplate: props.computeResources.launchTemplate,
         maxvCpus: props.computeResources.maxvCpus || 256,
         placementGroup: props.computeResources.placementGroup,
-        securityGroupIds: this.getSecurityGroupIds(),
+        securityGroupIds: this.getSecurityGroupIds(useLaunchTemplateNetworkInterface),
         spotIamFleetRole: spotFleetRole?.roleArn,
         subnets: props.computeResources.vpc.selectSubnets(props.computeResources.vpcSubnets).subnetIds,
         tags: props.computeResources.computeResourcesTags,
@@ -547,6 +564,12 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment,
           throw new Error('You must specify either the launch template ID or launch template name in the request.');
         }
 
+        // useNetworkInterfaceSecurityGroups cannot have securityGroups defined
+        if (props.computeResources.launchTemplate?.useNetworkInterfaceSecurityGroups &&
+            props.computeResources.securityGroups ) {
+          throw new Error('securityGroups cannot be specified if launchTemplate useNetworkInterfaceSecurityGroups is active');
+        }
+
         // Setting a bid percentage is only allowed on SPOT resources +
         // Cannot use SPOT_CAPACITY_OPTIMIZED when using ON_DEMAND
         if (props.computeResources.type === ComputeResourceType.ON_DEMAND) {
@@ -584,9 +607,9 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment,
     return instanceTypes.map((type: ec2.InstanceType) => type.toString());
   }
 
-  private buildConnections(vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections {
+  private buildConnections(useLaunchTemplateNetworkInterface: boolean, vpc?: ec2.IVpc, securityGroups?:ec2.ISecurityGroup[]): ec2.Connections {
 
-    if (vpc === undefined) {
+    if (vpc === undefined || useLaunchTemplateNetworkInterface ) {
       return new ec2.Connections({});
     }
 
@@ -597,12 +620,12 @@ export class ComputeEnvironment extends Resource implements IComputeEnvironment,
         ],
       });
     }
-
     return new ec2.Connections({ securityGroups });
   };
 
-  private getSecurityGroupIds(): string[] | undefined {
-    if (this.connections === undefined) {
+  private getSecurityGroupIds(useLaunchTemplateInterface: boolean): string[] | undefined {
+    if (this.connections === undefined ||
+      useLaunchTemplateInterface ) {
       return undefined;
     }
 
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json
new file mode 100644
index 0000000000000..9e26dfeeb6e64
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json
new file mode 100644
index 0000000000000..df41e422f123d
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/batch-stack.template.json
@@ -0,0 +1,452 @@
+{
+ "Resources": {
+  "vpcA2121C38": {
+   "Type": "AWS::EC2::VPC",
+   "Properties": {
+    "CidrBlock": "10.0.0.0/16",
+    "EnableDnsHostnames": true,
+    "EnableDnsSupport": true,
+    "InstanceTenancy": "default",
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc"
+     }
+    ]
+   }
+  },
+  "vpcPublicSubnet1Subnet2E65531E": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.0.0/17",
+    "MapPublicIpOnLaunch": true,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Public"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Public"
+     },
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "vpcPublicSubnet1RouteTable48A2DF9B": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "vpcPublicSubnet1RouteTableAssociation5D3F4579": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "vpcPublicSubnet1RouteTable48A2DF9B"
+    },
+    "SubnetId": {
+     "Ref": "vpcPublicSubnet1Subnet2E65531E"
+    }
+   }
+  },
+  "vpcPublicSubnet1DefaultRoute10708846": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "vpcPublicSubnet1RouteTable48A2DF9B"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "GatewayId": {
+     "Ref": "vpcIGWE57CBDCA"
+    }
+   },
+   "DependsOn": [
+    "vpcVPCGW7984C166"
+   ]
+  },
+  "vpcPublicSubnet1EIPDA49DCBE": {
+   "Type": "AWS::EC2::EIP",
+   "Properties": {
+    "Domain": "vpc",
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PublicSubnet1"
+     }
+    ]
+   }
+  },
+  "vpcPublicSubnet1NATGateway9C16659E": {
+   "Type": "AWS::EC2::NatGateway",
+   "Properties": {
+    "SubnetId": {
+     "Ref": "vpcPublicSubnet1Subnet2E65531E"
+    },
+    "AllocationId": {
+     "Fn::GetAtt": [
+      "vpcPublicSubnet1EIPDA49DCBE",
+      "AllocationId"
+     ]
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PublicSubnet1"
+     }
+    ]
+   },
+   "DependsOn": [
+    "vpcPublicSubnet1DefaultRoute10708846",
+    "vpcPublicSubnet1RouteTableAssociation5D3F4579"
+   ]
+  },
+  "vpcPrivateSubnet1Subnet934893E8": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    },
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.128.0/17",
+    "MapPublicIpOnLaunch": false,
+    "Tags": [
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "Private"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Private"
+     },
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PrivateSubnet1"
+     }
+    ]
+   }
+  },
+  "vpcPrivateSubnet1RouteTableB41A48CC": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    },
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc/PrivateSubnet1"
+     }
+    ]
+   }
+  },
+  "vpcPrivateSubnet1RouteTableAssociation67945127": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
+    },
+    "SubnetId": {
+     "Ref": "vpcPrivateSubnet1Subnet934893E8"
+    }
+   }
+  },
+  "vpcPrivateSubnet1DefaultRoute1AA8E2E5": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
+    },
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "NatGatewayId": {
+     "Ref": "vpcPublicSubnet1NATGateway9C16659E"
+    }
+   }
+  },
+  "vpcIGWE57CBDCA": {
+   "Type": "AWS::EC2::InternetGateway",
+   "Properties": {
+    "Tags": [
+     {
+      "Key": "Name",
+      "Value": "batch-stack/vpc"
+     }
+    ]
+   }
+  },
+  "vpcVPCGW7984C166": {
+   "Type": "AWS::EC2::VPCGatewayAttachment",
+   "Properties": {
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    },
+    "InternetGatewayId": {
+     "Ref": "vpcIGWE57CBDCA"
+    }
+   }
+  },
+  "EFASecurityGroupB5A52193": {
+   "Type": "AWS::EC2::SecurityGroup",
+   "Properties": {
+    "GroupDescription": "batch-stack/EFASecurityGroup",
+    "SecurityGroupEgress": [
+     {
+      "CidrIp": "0.0.0.0/0",
+      "Description": "Allow all outbound traffic by default",
+      "IpProtocol": "-1"
+     }
+    ],
+    "VpcId": {
+     "Ref": "vpcA2121C38"
+    }
+   }
+  },
+  "ec2launchtemplateefa": {
+   "Type": "AWS::EC2::LaunchTemplate",
+   "Properties": {
+    "LaunchTemplateData": {
+     "NetworkInterfaces": [
+      {
+       "DeviceIndex": 0,
+       "Groups": [
+        {
+         "Fn::GetAtt": [
+          "EFASecurityGroupB5A52193",
+          "GroupId"
+         ]
+        }
+       ],
+       "InterfaceType": "efa",
+       "SubnetId": {
+        "Ref": "vpcPrivateSubnet1Subnet934893E8"
+       }
+      }
+     ]
+    },
+    "LaunchTemplateName": "EC2LaunchTemplateEFA"
+   }
+  },
+  "EFABatchEcsInstanceRole9A232F28": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": {
+         "Fn::Join": [
+          "",
+          [
+           "ec2.",
+           {
+            "Ref": "AWS::URLSuffix"
+           }
+          ]
+         ]
+        }
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
+       ]
+      ]
+     }
+    ]
+   },
+   "DependsOn": [
+    "vpcIGWE57CBDCA",
+    "vpcPrivateSubnet1DefaultRoute1AA8E2E5",
+    "vpcPrivateSubnet1RouteTableB41A48CC",
+    "vpcPrivateSubnet1RouteTableAssociation67945127",
+    "vpcPrivateSubnet1Subnet934893E8",
+    "vpcPublicSubnet1DefaultRoute10708846",
+    "vpcPublicSubnet1EIPDA49DCBE",
+    "vpcPublicSubnet1NATGateway9C16659E",
+    "vpcPublicSubnet1RouteTable48A2DF9B",
+    "vpcPublicSubnet1RouteTableAssociation5D3F4579",
+    "vpcPublicSubnet1Subnet2E65531E",
+    "vpcA2121C38",
+    "vpcVPCGW7984C166"
+   ]
+  },
+  "EFABatchInstanceProfile3450D107": {
+   "Type": "AWS::IAM::InstanceProfile",
+   "Properties": {
+    "Roles": [
+     {
+      "Ref": "EFABatchEcsInstanceRole9A232F28"
+     }
+    ]
+   },
+   "DependsOn": [
+    "vpcIGWE57CBDCA",
+    "vpcPrivateSubnet1DefaultRoute1AA8E2E5",
+    "vpcPrivateSubnet1RouteTableB41A48CC",
+    "vpcPrivateSubnet1RouteTableAssociation67945127",
+    "vpcPrivateSubnet1Subnet934893E8",
+    "vpcPublicSubnet1DefaultRoute10708846",
+    "vpcPublicSubnet1EIPDA49DCBE",
+    "vpcPublicSubnet1NATGateway9C16659E",
+    "vpcPublicSubnet1RouteTable48A2DF9B",
+    "vpcPublicSubnet1RouteTableAssociation5D3F4579",
+    "vpcPublicSubnet1Subnet2E65531E",
+    "vpcA2121C38",
+    "vpcVPCGW7984C166"
+   ]
+  },
+  "EFABatchResourceServiceInstanceRoleD10C6691": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "batch.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSBatchServiceRole"
+       ]
+      ]
+     }
+    ]
+   },
+   "DependsOn": [
+    "vpcIGWE57CBDCA",
+    "vpcPrivateSubnet1DefaultRoute1AA8E2E5",
+    "vpcPrivateSubnet1RouteTableB41A48CC",
+    "vpcPrivateSubnet1RouteTableAssociation67945127",
+    "vpcPrivateSubnet1Subnet934893E8",
+    "vpcPublicSubnet1DefaultRoute10708846",
+    "vpcPublicSubnet1EIPDA49DCBE",
+    "vpcPublicSubnet1NATGateway9C16659E",
+    "vpcPublicSubnet1RouteTable48A2DF9B",
+    "vpcPublicSubnet1RouteTableAssociation5D3F4579",
+    "vpcPublicSubnet1Subnet2E65531E",
+    "vpcA2121C38",
+    "vpcVPCGW7984C166"
+   ]
+  },
+  "EFABatchEC058146": {
+   "Type": "AWS::Batch::ComputeEnvironment",
+   "Properties": {
+    "Type": "MANAGED",
+    "ComputeResources": {
+     "AllocationStrategy": "BEST_FIT",
+     "InstanceRole": {
+      "Fn::GetAtt": [
+       "EFABatchInstanceProfile3450D107",
+       "Arn"
+      ]
+     },
+     "InstanceTypes": [
+      "c5n.18xlarge"
+     ],
+     "LaunchTemplate": {
+      "LaunchTemplateName": "EC2LaunchTemplateEFA"
+     },
+     "MaxvCpus": 256,
+     "MinvCpus": 0,
+     "Subnets": [
+      {
+       "Ref": "vpcPrivateSubnet1Subnet934893E8"
+      }
+     ],
+     "Type": "EC2"
+    },
+    "ServiceRole": {
+     "Fn::GetAtt": [
+      "EFABatchResourceServiceInstanceRoleD10C6691",
+      "Arn"
+     ]
+    },
+    "State": "ENABLED"
+   },
+   "DependsOn": [
+    "vpcIGWE57CBDCA",
+    "vpcPrivateSubnet1DefaultRoute1AA8E2E5",
+    "vpcPrivateSubnet1RouteTableB41A48CC",
+    "vpcPrivateSubnet1RouteTableAssociation67945127",
+    "vpcPrivateSubnet1Subnet934893E8",
+    "vpcPublicSubnet1DefaultRoute10708846",
+    "vpcPublicSubnet1EIPDA49DCBE",
+    "vpcPublicSubnet1NATGateway9C16659E",
+    "vpcPublicSubnet1RouteTable48A2DF9B",
+    "vpcPublicSubnet1RouteTableAssociation5D3F4579",
+    "vpcPublicSubnet1Subnet2E65531E",
+    "vpcA2121C38",
+    "vpcVPCGW7984C166"
+   ]
+  },
+  "batchjobqueueE3C528F2": {
+   "Type": "AWS::Batch::JobQueue",
+   "Properties": {
+    "ComputeEnvironmentOrder": [
+     {
+      "ComputeEnvironment": {
+       "Ref": "EFABatchEC058146"
+      },
+      "Order": 1
+     }
+    ],
+    "Priority": 1,
+    "State": "ENABLED"
+   }
+  }
+ }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out
new file mode 100644
index 0000000000000..588d7b269d34f
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"20.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json
new file mode 100644
index 0000000000000..966e9214aa85c
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/integ.json
@@ -0,0 +1,11 @@
+{
+  "version": "20.0.0",
+  "testCases": {
+    "BatchWithEFATest/DefaultTest": {
+      "stacks": [
+        "batch-stack"
+      ],
+      "assertionStack": "BatchWithEFATest/DefaultTest/DeployAssert"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json
new file mode 100644
index 0000000000000..16001255cab21
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/manifest.json
@@ -0,0 +1,151 @@
+{
+  "version": "20.0.0",
+  "artifacts": {
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    },
+    "batch-stack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "batch-stack.template.json",
+        "validateOnSynth": false
+      },
+      "metadata": {
+        "/batch-stack/vpc/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcA2121C38"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1Subnet2E65531E"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1RouteTable48A2DF9B"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1RouteTableAssociation5D3F4579"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1DefaultRoute10708846"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/EIP": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1EIPDA49DCBE"
+          }
+        ],
+        "/batch-stack/vpc/PublicSubnet1/NATGateway": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPublicSubnet1NATGateway9C16659E"
+          }
+        ],
+        "/batch-stack/vpc/PrivateSubnet1/Subnet": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPrivateSubnet1Subnet934893E8"
+          }
+        ],
+        "/batch-stack/vpc/PrivateSubnet1/RouteTable": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPrivateSubnet1RouteTableB41A48CC"
+          }
+        ],
+        "/batch-stack/vpc/PrivateSubnet1/RouteTableAssociation": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPrivateSubnet1RouteTableAssociation67945127"
+          }
+        ],
+        "/batch-stack/vpc/PrivateSubnet1/DefaultRoute": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcPrivateSubnet1DefaultRoute1AA8E2E5"
+          }
+        ],
+        "/batch-stack/vpc/IGW": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcIGWE57CBDCA"
+          }
+        ],
+        "/batch-stack/vpc/VPCGW": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "vpcVPCGW7984C166"
+          }
+        ],
+        "/batch-stack/EFASecurityGroup/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "EFASecurityGroupB5A52193"
+          }
+        ],
+        "/batch-stack/ec2-launch-template-efa": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "ec2launchtemplateefa"
+          }
+        ],
+        "/batch-stack/EFABatch/Ecs-Instance-Role/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "EFABatchEcsInstanceRole9A232F28"
+          }
+        ],
+        "/batch-stack/EFABatch/Instance-Profile": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "EFABatchInstanceProfile3450D107"
+          }
+        ],
+        "/batch-stack/EFABatch/Resource-Service-Instance-Role/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "EFABatchResourceServiceInstanceRoleD10C6691"
+          }
+        ],
+        "/batch-stack/EFABatch/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "EFABatchEC058146"
+          }
+        ],
+        "/batch-stack/batch-job-queue/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "batchjobqueueE3C528F2"
+          }
+        ]
+      },
+      "displayName": "batch-stack"
+    },
+    "BatchWithEFATestDefaultTestDeployAssertDAD33663": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "BatchWithEFATestDefaultTestDeployAssertDAD33663.template.json",
+        "validateOnSynth": false
+      },
+      "displayName": "BatchWithEFATest/DefaultTest/DeployAssert"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json
new file mode 100644
index 0000000000000..d4072c3112b75
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/batch-with-efa.integ.snapshot/tree.json
@@ -0,0 +1,705 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "constructs.Construct",
+          "version": "10.1.78"
+        }
+      },
+      "batch-stack": {
+        "id": "batch-stack",
+        "path": "batch-stack",
+        "children": {
+          "vpc": {
+            "id": "vpc",
+            "path": "batch-stack/vpc",
+            "children": {
+              "Resource": {
+                "id": "Resource",
+                "path": "batch-stack/vpc/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::VPC",
+                  "aws:cdk:cloudformation:props": {
+                    "cidrBlock": "10.0.0.0/16",
+                    "enableDnsHostnames": true,
+                    "enableDnsSupport": true,
+                    "instanceTenancy": "default",
+                    "tags": [
+                      {
+                        "key": "Name",
+                        "value": "batch-stack/vpc"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.CfnVPC",
+                  "version": "0.0.0"
+                }
+              },
+              "PublicSubnet1": {
+                "id": "PublicSubnet1",
+                "path": "batch-stack/vpc/PublicSubnet1",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "batch-stack/vpc/PublicSubnet1/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "vpcA2121C38"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            0,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.0.0/17",
+                        "mapPublicIpOnLaunch": true,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Public"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnSubnet",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "batch-stack/vpc/PublicSubnet1/Acl",
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "batch-stack/vpc/PublicSubnet1/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "vpcA2121C38"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnRouteTable",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "batch-stack/vpc/PublicSubnet1/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "vpcPublicSubnet1RouteTable48A2DF9B"
+                        },
+                        "subnetId": {
+                          "Ref": "vpcPublicSubnet1Subnet2E65531E"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnSubnetRouteTableAssociation",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "batch-stack/vpc/PublicSubnet1/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "vpcPublicSubnet1RouteTable48A2DF9B"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "gatewayId": {
+                          "Ref": "vpcIGWE57CBDCA"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnRoute",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "EIP": {
+                    "id": "EIP",
+                    "path": "batch-stack/vpc/PublicSubnet1/EIP",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::EIP",
+                      "aws:cdk:cloudformation:props": {
+                        "domain": "vpc",
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnEIP",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "NATGateway": {
+                    "id": "NATGateway",
+                    "path": "batch-stack/vpc/PublicSubnet1/NATGateway",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::NatGateway",
+                      "aws:cdk:cloudformation:props": {
+                        "subnetId": {
+                          "Ref": "vpcPublicSubnet1Subnet2E65531E"
+                        },
+                        "allocationId": {
+                          "Fn::GetAtt": [
+                            "vpcPublicSubnet1EIPDA49DCBE",
+                            "AllocationId"
+                          ]
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PublicSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnNatGateway",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.PublicSubnet",
+                  "version": "0.0.0"
+                }
+              },
+              "PrivateSubnet1": {
+                "id": "PrivateSubnet1",
+                "path": "batch-stack/vpc/PrivateSubnet1",
+                "children": {
+                  "Subnet": {
+                    "id": "Subnet",
+                    "path": "batch-stack/vpc/PrivateSubnet1/Subnet",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Subnet",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "vpcA2121C38"
+                        },
+                        "availabilityZone": {
+                          "Fn::Select": [
+                            0,
+                            {
+                              "Fn::GetAZs": ""
+                            }
+                          ]
+                        },
+                        "cidrBlock": "10.0.128.0/17",
+                        "mapPublicIpOnLaunch": false,
+                        "tags": [
+                          {
+                            "key": "aws-cdk:subnet-name",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "aws-cdk:subnet-type",
+                            "value": "Private"
+                          },
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PrivateSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnSubnet",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "Acl": {
+                    "id": "Acl",
+                    "path": "batch-stack/vpc/PrivateSubnet1/Acl",
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/core.Resource",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "RouteTable": {
+                    "id": "RouteTable",
+                    "path": "batch-stack/vpc/PrivateSubnet1/RouteTable",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::RouteTable",
+                      "aws:cdk:cloudformation:props": {
+                        "vpcId": {
+                          "Ref": "vpcA2121C38"
+                        },
+                        "tags": [
+                          {
+                            "key": "Name",
+                            "value": "batch-stack/vpc/PrivateSubnet1"
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnRouteTable",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "RouteTableAssociation": {
+                    "id": "RouteTableAssociation",
+                    "path": "batch-stack/vpc/PrivateSubnet1/RouteTableAssociation",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::SubnetRouteTableAssociation",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
+                        },
+                        "subnetId": {
+                          "Ref": "vpcPrivateSubnet1Subnet934893E8"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnSubnetRouteTableAssociation",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "DefaultRoute": {
+                    "id": "DefaultRoute",
+                    "path": "batch-stack/vpc/PrivateSubnet1/DefaultRoute",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::EC2::Route",
+                      "aws:cdk:cloudformation:props": {
+                        "routeTableId": {
+                          "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
+                        },
+                        "destinationCidrBlock": "0.0.0.0/0",
+                        "natGatewayId": {
+                          "Ref": "vpcPublicSubnet1NATGateway9C16659E"
+                        }
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-ec2.CfnRoute",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.PrivateSubnet",
+                  "version": "0.0.0"
+                }
+              },
+              "IGW": {
+                "id": "IGW",
+                "path": "batch-stack/vpc/IGW",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::InternetGateway",
+                  "aws:cdk:cloudformation:props": {
+                    "tags": [
+                      {
+                        "key": "Name",
+                        "value": "batch-stack/vpc"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.CfnInternetGateway",
+                  "version": "0.0.0"
+                }
+              },
+              "VPCGW": {
+                "id": "VPCGW",
+                "path": "batch-stack/vpc/VPCGW",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::VPCGatewayAttachment",
+                  "aws:cdk:cloudformation:props": {
+                    "vpcId": {
+                      "Ref": "vpcA2121C38"
+                    },
+                    "internetGatewayId": {
+                      "Ref": "vpcIGWE57CBDCA"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.CfnVPCGatewayAttachment",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-ec2.Vpc",
+              "version": "0.0.0"
+            }
+          },
+          "EFASecurityGroup": {
+            "id": "EFASecurityGroup",
+            "path": "batch-stack/EFASecurityGroup",
+            "children": {
+              "Resource": {
+                "id": "Resource",
+                "path": "batch-stack/EFASecurityGroup/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::EC2::SecurityGroup",
+                  "aws:cdk:cloudformation:props": {
+                    "groupDescription": "batch-stack/EFASecurityGroup",
+                    "securityGroupEgress": [
+                      {
+                        "cidrIp": "0.0.0.0/0",
+                        "description": "Allow all outbound traffic by default",
+                        "ipProtocol": "-1"
+                      }
+                    ],
+                    "vpcId": {
+                      "Ref": "vpcA2121C38"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-ec2.CfnSecurityGroup",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-ec2.SecurityGroup",
+              "version": "0.0.0"
+            }
+          },
+          "ec2-launch-template-efa": {
+            "id": "ec2-launch-template-efa",
+            "path": "batch-stack/ec2-launch-template-efa",
+            "attributes": {
+              "aws:cdk:cloudformation:type": "AWS::EC2::LaunchTemplate",
+              "aws:cdk:cloudformation:props": {
+                "launchTemplateData": {
+                  "networkInterfaces": [
+                    {
+                      "deviceIndex": 0,
+                      "subnetId": {
+                        "Ref": "vpcPrivateSubnet1Subnet934893E8"
+                      },
+                      "interfaceType": "efa",
+                      "groups": [
+                        {
+                          "Fn::GetAtt": [
+                            "EFASecurityGroupB5A52193",
+                            "GroupId"
+                          ]
+                        }
+                      ]
+                    }
+                  ]
+                },
+                "launchTemplateName": "EC2LaunchTemplateEFA"
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-ec2.CfnLaunchTemplate",
+              "version": "0.0.0"
+            }
+          },
+          "EFABatch": {
+            "id": "EFABatch",
+            "path": "batch-stack/EFABatch",
+            "children": {
+              "Ecs-Instance-Role": {
+                "id": "Ecs-Instance-Role",
+                "path": "batch-stack/EFABatch/Ecs-Instance-Role",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "batch-stack/EFABatch/Ecs-Instance-Role/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": {
+                                  "Fn::Join": [
+                                    "",
+                                    [
+                                      "ec2.",
+                                      {
+                                        "Ref": "AWS::URLSuffix"
+                                      }
+                                    ]
+                                  ]
+                                }
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Instance-Profile": {
+                "id": "Instance-Profile",
+                "path": "batch-stack/EFABatch/Instance-Profile",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::IAM::InstanceProfile",
+                  "aws:cdk:cloudformation:props": {
+                    "roles": [
+                      {
+                        "Ref": "EFABatchEcsInstanceRole9A232F28"
+                      }
+                    ]
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.CfnInstanceProfile",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource-Service-Instance-Role": {
+                "id": "Resource-Service-Instance-Role",
+                "path": "batch-stack/EFABatch/Resource-Service-Instance-Role",
+                "children": {
+                  "Resource": {
+                    "id": "Resource",
+                    "path": "batch-stack/EFABatch/Resource-Service-Instance-Role/Resource",
+                    "attributes": {
+                      "aws:cdk:cloudformation:type": "AWS::IAM::Role",
+                      "aws:cdk:cloudformation:props": {
+                        "assumeRolePolicyDocument": {
+                          "Statement": [
+                            {
+                              "Action": "sts:AssumeRole",
+                              "Effect": "Allow",
+                              "Principal": {
+                                "Service": "batch.amazonaws.com"
+                              }
+                            }
+                          ],
+                          "Version": "2012-10-17"
+                        },
+                        "managedPolicyArns": [
+                          {
+                            "Fn::Join": [
+                              "",
+                              [
+                                "arn:",
+                                {
+                                  "Ref": "AWS::Partition"
+                                },
+                                ":iam::aws:policy/service-role/AWSBatchServiceRole"
+                              ]
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    "constructInfo": {
+                      "fqn": "@aws-cdk/aws-iam.CfnRole",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-iam.Role",
+                  "version": "0.0.0"
+                }
+              },
+              "Resource": {
+                "id": "Resource",
+                "path": "batch-stack/EFABatch/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Batch::ComputeEnvironment",
+                  "aws:cdk:cloudformation:props": {
+                    "type": "MANAGED",
+                    "computeResources": {
+                      "launchTemplate": {
+                        "useNetworkInterfaceSecurityGroups": true,
+                        "launchTemplateName": "EC2LaunchTemplateEFA"
+                      },
+                      "maxvCpus": 256,
+                      "subnets": [
+                        {
+                          "Ref": "vpcPrivateSubnet1Subnet934893E8"
+                        }
+                      ],
+                      "type": "EC2",
+                      "allocationStrategy": "BEST_FIT",
+                      "instanceRole": {
+                        "Fn::GetAtt": [
+                          "EFABatchInstanceProfile3450D107",
+                          "Arn"
+                        ]
+                      },
+                      "instanceTypes": [
+                        "c5n.18xlarge"
+                      ],
+                      "minvCpus": 0
+                    },
+                    "serviceRole": {
+                      "Fn::GetAtt": [
+                        "EFABatchResourceServiceInstanceRoleD10C6691",
+                        "Arn"
+                      ]
+                    },
+                    "state": "ENABLED"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-batch.CfnComputeEnvironment",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-batch.ComputeEnvironment",
+              "version": "0.0.0"
+            }
+          },
+          "batch-job-queue": {
+            "id": "batch-job-queue",
+            "path": "batch-stack/batch-job-queue",
+            "children": {
+              "Resource": {
+                "id": "Resource",
+                "path": "batch-stack/batch-job-queue/Resource",
+                "attributes": {
+                  "aws:cdk:cloudformation:type": "AWS::Batch::JobQueue",
+                  "aws:cdk:cloudformation:props": {
+                    "computeEnvironmentOrder": [
+                      {
+                        "computeEnvironment": {
+                          "Ref": "EFABatchEC058146"
+                        },
+                        "order": 1
+                      }
+                    ],
+                    "priority": 1,
+                    "state": "ENABLED"
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "@aws-cdk/aws-batch.CfnJobQueue",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/aws-batch.JobQueue",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/core.Stack",
+          "version": "0.0.0"
+        }
+      },
+      "BatchWithEFATest": {
+        "id": "BatchWithEFATest",
+        "path": "BatchWithEFATest",
+        "children": {
+          "DefaultTest": {
+            "id": "DefaultTest",
+            "path": "BatchWithEFATest/DefaultTest",
+            "children": {
+              "Default": {
+                "id": "Default",
+                "path": "BatchWithEFATest/DefaultTest/Default",
+                "constructInfo": {
+                  "fqn": "constructs.Construct",
+                  "version": "10.1.78"
+                }
+              },
+              "DeployAssert": {
+                "id": "DeployAssert",
+                "path": "BatchWithEFATest/DefaultTest/DeployAssert",
+                "constructInfo": {
+                  "fqn": "@aws-cdk/core.Stack",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/integ-tests.IntegTestCase",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/integ-tests.IntegTest",
+          "version": "0.0.0"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "@aws-cdk/core.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts
index d31a0f60e9a82..85c03a3c1e36f 100644
--- a/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts
+++ b/packages/@aws-cdk/aws-batch/test/compute-environment.test.ts
@@ -1,5 +1,5 @@
 import { throws } from 'assert';
-import { Template } from '@aws-cdk/assertions';
+import { Template, Match } from '@aws-cdk/assertions';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as iam from '@aws-cdk/aws-iam';
@@ -584,6 +584,49 @@ describe('Batch Compute Environment', () => {
       });
     });
 
+    describe('without useNetworkInterfaceSecurityGroups', () => {
+      test('should not have securityGroups', () => {
+        // THEN
+        throws(() => {
+          // WHEN
+          new batch.ComputeEnvironment(stack, 'test-compute-env', {
+            managed: true,
+            computeResources: {
+              vpc,
+              launchTemplate: {
+                useNetworkInterfaceSecurityGroups: true,
+                launchTemplateName: 'dummyname',
+              },
+              securityGroups: [],
+            },
+          });
+        });
+      });
+
+      test('should not have a SecurityGroupIds output', () => {
+        // WHEN
+        new batch.ComputeEnvironment(stack, 'efa-compute-env', {
+          managed: true,
+          computeResources: {
+            vpc,
+            launchTemplate: {
+              useNetworkInterfaceSecurityGroups: true,
+              launchTemplateName: 'dummyname',
+            },
+          },
+        });
+
+        // THEN
+        Template.fromStack(stack).hasResourceProperties(
+          'AWS::Batch::ComputeEnvironment', {
+            ComputeResources: {
+              SecurityGroupIds: Match.absent(),
+            },
+          },
+        );
+      });
+    });
+
     describe('connectable functions', () => {
       test('ec2 ingress rule', () => {
         const computeEnvironment = new batch.ComputeEnvironment(stack, 'test-compute-env', {
diff --git a/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts
new file mode 100644
index 0000000000000..63c1d84f3be42
--- /dev/null
+++ b/packages/@aws-cdk/aws-batch/test/integ.batch-with-efa.ts
@@ -0,0 +1,57 @@
+import * as ec2 from '@aws-cdk/aws-ec2';
+import * as cdk from '@aws-cdk/core';
+import * as integ from '@aws-cdk/integ-tests';
+import * as batch from '../lib/';
+
+export const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'batch-stack');
+
+const vpc = new ec2.Vpc(stack, 'vpc', { maxAzs: 1 });
+
+const efaSecurityGroup = new ec2.SecurityGroup(stack, 'EFASecurityGroup', {
+  vpc,
+});
+
+// While this test specifies EFA, the same behavior occurs with
+// interfaceType: 'interface' as well
+const launchTemplateEFA = new ec2.CfnLaunchTemplate(stack, 'ec2-launch-template-efa', {
+  launchTemplateName: 'EC2LaunchTemplateEFA',
+  launchTemplateData: {
+    networkInterfaces: [{
+      deviceIndex: 0,
+      subnetId: vpc.privateSubnets[0].subnetId,
+      interfaceType: 'efa',
+      groups: [efaSecurityGroup.securityGroupId],
+    }],
+  },
+});
+
+const computeEnvironmentEFA = new batch.ComputeEnvironment(stack, 'EFABatch', {
+  managed: true,
+  computeResources: {
+    type: batch.ComputeResourceType.ON_DEMAND,
+    instanceTypes: [new ec2.InstanceType('c5n.18xlarge')],
+    vpc,
+    launchTemplate: {
+      useNetworkInterfaceSecurityGroups: true,
+      launchTemplateName: launchTemplateEFA.launchTemplateName as string,
+    },
+  },
+});
+
+
+new batch.JobQueue(stack, 'batch-job-queue', {
+  computeEnvironments: [
+    {
+      computeEnvironment: computeEnvironmentEFA,
+      order: 1,
+    },
+  ],
+});
+
+new integ.IntegTest(app, 'BatchWithEFATest', {
+  testCases: [stack],
+});
+
+app.synth();
\ No newline at end of file