Docker pull error AWS ECR "unauthorized: authentication required"

Question

I logged in to AWS ECR repo and fired pull command but giving this error

# $(aws ecr get-login --no-include-email)
Login Succeeded

# docker pull 432354543235.dkr.ecr.us-east-1.amazonaws.com/abc-example:1.1.1                                        
Pulling repository 432354543235.dkr.ecr.us-east-1.amazonaws.com/abc-example:1.1.1
unauthorized: authentication required

Answer 1

Amazon have well documented how to use the AWS CLI to allow docker to authenticate to an Amazon ECR registry.

However, get-login has now been deprecated. You will need to use get-login-password instead.

They note in their documentation that you can pass the authentication token to the docker login command. You will need to specify the Amazon ECR registry URI you want to authenticate to as well.

For example

$ aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.us-east-1.amazonaws.com

I can then pull the image according to registry/repository[:tag].

Registry is a combination of your Account ID and the regional ECR endpoint, e.g:

123456789012.dkr.ecr.us-east-1.amazonaws.com

Repository is the name of the place to store images e.g:

myrepo

Tag is the usual image metadata, e.g.: latest

Below is a complete example of authenticating and pulling an image:

$ aws ecr get-login-password --region ap-southeast-2 \
  | docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.ap-southeast-2.amazonaws.com

$ docker pull 123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/myrepo:latest
latest: Pulling from myrepo
5bed26d33875: Pull complete
Digest: sha256:aabbccdd
Status: Downloaded newer image for 123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/myrepo:latest
123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/myrepo:latest