Theoretically we can remove the rBuildsBatchIamRole because the AWSServiceRoleForBatch will be automatically created if we don't specify a service role for the compute environment

serverless-resources.yml

@@ -6,21 +6,6 @@ rBuildsSecurityGroup:
     VpcId: ${self:custom.vpcId}
     Tags: ${self:provider.tagsList}
 
-
-rBuildsBatchIamRole:
-  Type: AWS::IAM::Role
-  Properties:
-    Path: /service-role/
-    AssumeRolePolicyDocument:
-      Version: '2012-10-17'
-      Statement:
-        - Effect: Allow
-          Principal:
-            Service:
-              - batch.amazonaws.com
-          Action: sts:AssumeRole
-    ManagedPolicyArns:
-      - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
 rBuildsSpotFleetIamRole:
   Type: AWS::IAM::Role
   Properties:
@@ -103,8 +88,6 @@ rBuildsBatchComputeEnvironment:
   DependsOn: rBuildsBatchIamRole
   Properties:
     Type: MANAGED
-    ServiceRole:
-      "Fn::GetAtt": [ rBuildsBatchIamRole, Arn ]
     ComputeResources:
       AllocationStrategy: BEST_FIT_PROGRESSIVE
       LaunchTemplate:
@@ -135,6 +118,7 @@ rBuildsBatchComputeEnvironment:
       MinvCpus: 0
       DesiredvCpus: 0
       MaxvCpus: 256
+      UpdateToLatestImageVersion: true
 
 rBuildsBatchJobQueue:
   Type: AWS::Batch::JobQueue