That CloudFormation construct is to provide environment variables key/value pairs that you can take advantage of in your application without giving the application a job role that has access to Secrets Manager.

If you want dynamic access to secrets (which is not something that I would recommend - but since you are asking) you should add a profile to the Batch job role that allows access to subset of entries in Secrets Manager that you want to give to an application. Here is an example policy that leverages tags for access: https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access-abac.html#tag-secrets-abac

Again - I do not recommend dynamic access to secrets. That's just a security incident waiting to happen. But since you asked, adding access to a tagged set of secrets via the job role is an not-terrible compromise.

Note that your application would need to leverage the Secrets Manager API (via SDK, CLI, etc) to get the secrets, instead of relying on Batch to place them into environment variables.