aws cdk ecs task scheduling specify existing securitygroup - aws-sdk

Question

When defining an ECS Task Schedule, I can't seem to find a way of specifying an existing security group. Any pointers on where this can be configured using aws cdk?
In the code snippet below, you'll see I am able to create a cron, specify the docker image to schedule and create the schedule itself by specifying the existing cluster and vpc. However, there is no option to specify an existing security group... Is it possible to specify an existing security group?
schedule_cron = scaling.Schedule.cron(minute=manifest['schedule']['minute'],
hour=manifest['schedule']['hour'],
day=manifest['schedule']['day'],
month=manifest['schedule']['month'],
year=manifest['schedule']['year'])
image_option = ecs_patterns.ScheduledFargateTaskImageOptions(image=img,
cpu=manifest["resources"]["cpu"],
memory_limit_mib=manifest["resources"]["memory"],
log_driver=ecs.AwsLogDriver(log_group=log_group,
stream_prefix=manifest["app_name"]),
secrets=secrets,
environment= env)
schedule_pattern = ecs_patterns.ScheduledFargateTask(self, f"scheduledtask{app_name}",
schedule= schedule_cron, scheduled_fargate_task_image_options=image_option, cluster=cluster,
desired_task_count=manifest["replica_count"], vpc=vpc)

Answer 1

The ECS Patterns does not support this yet. The underlying constructs however do. Therefore you must specify the TaskDefinition, Event and Event Target yourself.. With Event the schedule is specified and with Event Target the SecurityGroup is set.
Here is an example implementation using TypeScript. Please adjust this to Python using the aws_cdk.aws_events and aws_cdk.aws_events_targets modules.
import aas = require('#aws-cdk/aws-applicationautoscaling');
import cdk = require('#aws-cdk/core');
import events = require("#aws-cdk/aws-events")
import event_targets = require("#aws-cdk/aws-events-targets");
import ec2 = require('#aws-cdk/aws-ec2');
const securityGroup = new ec2.SecurityGroup(this, "SecurityGroup", {
vpc: vpc,
});
const task = new ecs.FargateTaskDefinition(this, "TaskDefinition", {
family: "ScheduledTask",
cpu: ..,
memoryLimitMiB: ..,
});
task.addContainer("app_name", ...);
const rule = new events.Rule(this, "Rule", {
description: "ScheduledTask app_name Trigger",
enabled: true,
schedule: aas.Schedule.rate(cdk.Duration.hours(1)),
targets: [
new event_targets.EcsTask({
cluster: cluster,
taskDefinition: task,
securityGroup: securityGroup,
}),
],
});
Please note that the EcsTask event target only allows one security group. This issue was raised a while ago on GitHub: https://github.com/aws/aws-cdk/issues/3312