Secrets Manager with Fargate

import json
import aws_cdk as cdk
from constructs import Construct

from aws_cdk import (
    Stack,
    aws_ec2 as ec2,
    aws_ecs as ecs,
    aws_secretsmanager as sm,
    aws_iam as iam
)

class FargateSecretsManagerStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        #Retrieve the first public subnet available in the default VPC in the AWS account. The subnet ID will be used to run a task
        fargate_vpc = ec2.Vpc.from_lookup(self, "Vpc", is_default=True)
        public_subnet = fargate_vpc.public_subnets[0]

        fargate_cluster = ecs.Cluster(self, "FargateCluster", cluster_name="FargateCluster", vpc=fargate_vpc)

        #Generate secret in Secrets Manager (in this example, the password is randomly generated)
        secret = sm.Secret(self, "FargateSecret",
            generate_secret_string=sm.SecretStringGenerator(
                secret_string_template=json.dumps({"username": "user"}),
                generate_string_key="password",
                include_space=False,
                require_each_included_type=True
              )
            )

        #Create Fargate Execution Role
        fargate_role = iam.Role(self, "FargateTaskExecutionRole",
            assumed_by=iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
            description="Fargate Task Execution Role",
            )

        fargate_task_def = ecs.FargateTaskDefinition(self, "FargateTaskDefinition",
            memory_limit_mib=1024,
            cpu=256,
            execution_role=fargate_role
            )

        fargate_container = fargate_task_def.add_container("FargateContainer",
            image=ecs.ContainerImage.from_registry("amazon/amazon-ecs-sample"),
            memory_limit_mib=512,
            logging=ecs.LogDrivers.aws_logs(stream_prefix="FargateDemo"),
            #Secrets are retrieved from AWS Secrets Manager at container start-up
            secrets={ 
                "USERNAME": ecs.Secret.from_secrets_manager(secret, "username"),
                "PASSWORD": ecs.Secret.from_secrets_manager(secret, "password")  #This syntax will reference a specific JSON field in the secret, i.e. 'password'. (Requires platform version 1.4.0 or later for Fargate tasks)
            },
            command=["printenv"]
        )

        #Print out resource names/ARNs for use in testing
        cdk.CfnOutput(self, "TaskDefinitionName", description="Name of Fargate Task Definition with version", value=fargate_task_def.task_definition_arn)
        cdk.CfnOutput(self, "Cluster", description="Cluster to run Fargate Tasks", value=fargate_cluster.cluster_name)
        cdk.CfnOutput(self, "Task Run Subnet", description="Subnet to run Fargate Tasks", value=public_subnet.subnet_id)