What is the proper way to log in to ECR?

Question

Currently, I have this command in my bash script for building & pushing an image to Amazon ECR

docker login -u AWS -p "$(aws ecr get-login-password)" "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.us-east-1.amazonaws.com"

Which gives the warning "WARNING! Using --password via the CLI is insecure. Use --password-stdin."

How can I change this command to not give the warning? Is this really insecure?

Yes, because the password is briefly visible in the process lists for any process to read. — Epeli, May 14 '20 at 06:07

score 6 · Accepted Answer · answered Feb 28 '20 at 05:05

6

Tinkering around this seems to work well:

aws ecr get-login-password | docker login -u AWS --password-stdin "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.us-east-1.amazonaws.com"

answered Feb 28 '20 at 05:05

Moak

604
2
10
29

Hrm this fails with `Error response from daemon: login attempt to https://longnumber.dkr.ecr.us-east-1.amazonaws.com/v2/ failed with status: 400 Bad Request` – mikemaccana Jun 25 '21 at 10:25
https://stackoverflow.com/a/61854312/4989929 – Ronak Poriya Jun 21 '22 at 06:18

score 2 · Answer 2 · answered Mar 28 '21 at 08:34

2

$(aws ecr get-login --no-include-email --region cn-northwest-1)

replace cn-northwest-1 as your region.

answered Mar 28 '21 at 08:34

ola

21
1

It might work, but that command is deprecated – Moak Mar 29 '21 at 18:58
@Moak where does AWS say `aws ecr get-login` is deprecated? – mikemaccana Jun 25 '21 at 10:23

score 1 · Answer 3 · answered Feb 28 '20 at 04:08

1

The recommended way to log in to ECR is to use the command produced by aws ecr get-login.

answered Feb 28 '20 at 04:08

User9123

111
4

1

That's a deprecated command not available to us – Moak Feb 28 '20 at 05:00

score 0 · Answer 4 · answered Sep 16 '21 at 17:47

Assuming the AWS CLI is already configured correctly, for example with:

aws configure

Then just call the following:

aws ecr get-login-password | docker login -u AWS --password-stdin "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.$(aws configure get region).amazonaws.com"

The previous command aws ecr get-login automatically resolved the Account ID and region. The above command does that explicitly:

$(aws sts get-caller-identity --query 'Account' --output text)

(as per @Moak's answer, thank you)

and:

$(aws configure get region)

to get the region.

What is the proper way to log in to ECR?

4 Answers4