aws-batch: Unable to create Windows Fargate Job Definition due to invalid generated CF Template

[juantula]

Describe the bug

When trying to create an EcsJobDefinitionInstance, using a container of type EcsFargateContainerDefinition, with fargateCpuArchitecture=X86_64 and fargateOperatingSystemFamily=WINDOWS_SERVER_2019_FULL (but it also happens with any of the valid WINDOWS options too), I get the following error (after executing npx cdk deploy --all):

AWS::Batch::JobDefinition | WindowsJobDefinition (WindowsJobDefinition4BE72269) An error occurred (ClientException) when calling the RegisterJobDefinition operation: Error executing request, Exception : ReadonlyRootFilesystem parameter is not supported for Windows containers, RequestId: 2432267b-cacf-403e-9a70-1f7d565e814d

Expected Behavior

A new JobDefinition is created successfuly

Current Behavior

AWS::Batch::JobDefinition | WindowsJobDefinition (WindowsJobDefinition4BE72269) An error occurred (ClientException) when calling the RegisterJobDefinition operation: Error executing request, Exception : ReadonlyRootFilesystem parameter is not supported for Windows containers, RequestId: 2432267b-cacf-403e-9a70-1f7d565e814d

Reproduction Steps

const windowsJobDefinition = new batch.EcsJobDefinition(this, "WindowsJobDefinition", {
      jobDefinitionName: "windows-job-definition",
      container: new batch.EcsFargateContainerDefinition(this, "WindowsFargateContainer", {
        image: ecs.ContainerImage.fromRegistry("mcr.microsoft.com/dotnet/framework/runtime:4.7.2"),
        memory: cdk.Size.gibibytes(8),
        cpu: 2, 
        fargateCpuArchitecture: ecs.CpuArchitecture.X86_64,
        fargateOperatingSystemFamily: ecs.OperatingSystemFamily.WINDOWS_SERVER_2019_FULL,
      }),
    });

Possible Solution

The generated CloudFormation template looks like this:

{
  "WindowsJobDefinition4BE72269": {
   "Type": "AWS::Batch::JobDefinition",
   "Properties": {
    "ContainerProperties": {
     "Environment": [],
     "ExecutionRoleArn": {
      "Fn::GetAtt": [
       "WindowsFargateContainerExecutionRoleAE15A6C1",
       "Arn"
      ]
     },
     "FargatePlatformConfiguration": {},
     "Image": "mcr.microsoft.com/dotnet/framework/runtime:4.7.2",
     "NetworkConfiguration": {
      "AssignPublicIp": "DISABLED"
     },
     "ReadonlyRootFilesystem": false,
     "ResourceRequirements": [
      {
       "Type": "MEMORY",
       "Value": "8192"
      },
      {
       "Type": "VCPU",
       "Value": "2"
      }
     ],
     "RuntimePlatform": {
      "CpuArchitecture": "X86_64",
      "OperatingSystemFamily": "WINDOWS_SERVER_2019_FULL"
     }
    },
    "JobDefinitionName": "windows-job-definition",
    "PlatformCapabilities": [
     "FARGATE"
    ],
    "RetryStrategy": {},
    "Timeout": {},
    "Type": "container"
   },
   "Metadata": {
    "aws:cdk:path": "Stack/WindowsJobDefinition/Resource"
   }
  }
}

It can be seen that it has an "ReadonlyRootFilesystem": false, attribute. I imagine in the case of Windows containers, that attribute should not be present at all.

Additional Information/Context

Trying to build a Linux Job Definition works just fine, with all the same parameters (all but the operatingSystemFamily and the docker image name).
The issue also happens with all the previous CDK versions that include support for specifying the OS family (2.125.0, 2.126.0, 2.127.0)

CDK CLI Version

2.128.0

Framework Version

2.128.0

Node.js Version

v18.19.0

OS

Microsoft Windows [Version 10.0.19045.3930]

Language

TypeScript

Language Version

5.3.3

Other information

No response

[pahud]

Thank you for the report and we'll review @msambol 's PR to move this forward.

[jerometremblay]

In the meantime, we can patch the generated CloudFormation template.

const jobDefinition = new batch.EcsJobDefinition(this, 'JobDefinition', { ... });
const cfnJobDefinition = jobDefinition.node.defaultChild as batch.CfnJobDefinition;
cfnJobDefinition.addPropertyOverride('ContainerProperties.ReadonlyRootFilesystem', undefined);

[juantula]

In the meantime, we can patch the generated CloudFormation template.

const jobDefinition = new batch.EcsJobDefinition(this, 'JobDefinition', { ... });
const cfnJobDefinition = jobDefinition.node.defaultChild as batch.CfnJobDefinition;
cfnJobDefinition.addPropertyOverride('ContainerProperties.ReadonlyRootFilesystem', undefined);

Yup, that works, and it's better than editing the compiled JS code, as I was doing, thanks!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.