How to correctly set allowFrom or allowTo connection to other resources for ScheduledFargateTask

[5t111111]

I encounter a problem when creating ScheduledFargateTask which requrires database connections. You can configure connections to database via allowTo or allowFrom when creating ECS services ( e.g. ApplicationLoadBalancedFargateService ), while you cannot do the same way for ScheduledFargateTask construct.

I have found the related issue #7400 , but it is still not clear how to correctly set allowFrom or allowTo connection to other resources for ScheduledFargateTask.

For example:

import {
  Stack,
  StackProps,
  aws_ecs_patterns as ecsPatterns,
  aws_ec2 as ec2,
  aws_rds as rds,
  aws_applicationautoscaling as appscaling,
  Duration,
} from "aws-cdk-lib";
import { Construct } from "constructs";

export class TestStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, "Vpc");

    const database = new rds.DatabaseInstance(this, "Database", {
      vpc,
      engine: rds.DatabaseInstanceEngine.mysql({
        version: rds.MysqlEngineVersion.VER_8_0_26,
      }),
    });

    const loadBalancedFargateService =
      new ecsPatterns.ApplicationLoadBalancedFargateService(this, "Service", {
        vpc,
      });

    const scheduledFargateTask = new ecsPatterns.ScheduledFargateTask(
      this,
      "Task",
      {
        cluster: loadBalancedFargateService.cluster,
        schedule: appscaling.Schedule.rate(Duration.minutes(10)),
      }
    );

    /**
     * You can allow connection from service to database
     */
    loadBalancedFargateService.service.connections.allowTo(
      database,
      ec2.Port.tcp(3306)
    );

    /**
     * You **cannot** allow connection from service to database like service
     */
    // scheduledFargateTask. ???? .allowTo(
    //   database,
    //   ec2.Port.tcp(3306)
    // );
  }
}

The only workaround I have found so far is the following, but I know it is not reliable solution:

    /**
     * The only workaround I've found so far is setting the same security group of a service
     */
    const scheduledFargateTask = new ecsPatterns.ScheduledFargateTask(
      this,
      "Task",
      {
        cluster: loadBalancedFargateService.cluster,
        schedule: appscaling.Schedule.rate(Duration.minutes(10)),
        securityGroups: [
          loadBalancedFargateService.service.connections.securityGroups[0],
        ],
      }
    );

Does anyone know the correct ways to set connections to the other resources for ScheduledFargateTask ?

[MrArnoldPalmer]

I think the workaround suggested here is what is needed for now, #7400 (comment)

Lemme know if that works.

[kateile]

@5t111111 I face similar issue. What did you endup using?