Can't push image to Amazon ECR - fails with “no basic auth credentials”

Question

I\'m trying to push a docker image to an Amazon ECR registry. I\'m using docker client Docker version 1.9.1, build a34a1d5. I use aws ecr get-login --regi

Answer 1

1. Make sure you have created the ECR registry first.
   Then as per the ECR Push Command Instructions, cut and paste the following commands
2. Execute the docker login command (eval on Mac/Linux skips the cut-and-paste)
   eval $(aws ecr get-login --region us-east-1)
   add --profile if you use multiple AWS Accounts
   eval $(aws ecr get-login --region us-east-1 --profile your-profile)
3. docker build -t image-name .
4. docker tag image-name:latest ############.dkr.ecr.us-east-1.amazonaws.com/image-name:latest
5. docker push ############.dkr.ecr.us-east-1.amazonaws.com/image-name:latest

In case of error, make sure you run all the commands again! The credentials you get using aws ecr get-login are temporary and will expire.

Answer 2

In my case this was a bug with Docker for Windows and their support for the Windows Credential Manager.

Open your ~/.docker/config.json and remove the "credsStore": "wincred" entry.

This will cause credentials to be written to the config.json directly. You'll have to log in again afterwards.

You can track this bug through the tickets #22910 and #24968 on GitHub.

Answer 3

If it helps anyone...

My problem was that I had to use the --profile option in order to authenticate with the proper profile from the credentials file.

Next, I had ommitted the --region [region_name] command, which also gave the "no basic auth credentials" error.

The solution for me was changing my command from this:

aws ecr get-login

To this:

aws --profile [profile_name] ecr get-login --region [region_name]

Example:

aws --profile foo ecr get-login --region us-east-1

Hope that helps someone!

Answer 4

Just adding to this as in case someone out there is suffering from never Reading The F Manual like me
I followed all the suggested steps from above such as

aws ecr get-login-password --region eu-west-1 | docker login --username AWS --password-stdin 123456789.dkr.ecr.eu-west-1.amazonaws.com

And always got the no basic auth credentials
I had created a registry named

123456789.dkr.ecr.eu-west-1.amazonaws.com/my.registry.com/namespace 

and was trying to push an image called alpine:latest

123456789.dkr.ecr.eu-west-1.amazonaws.com/my.registry.com/namespace/alpine:latest
2c6e8b76de: Preparing
9d4cb0c1e9: Preparing
1ca55f6ab4: Preparing
b6fd41c05e: Waiting
ad44a79b33: Waiting
2ce3c1888d: Waiting
no basic auth credentials   

Silly mistake on my behalf as I must create a registry in ecr using the full container path.
I created a new registry using the full container path, not ending on the namespace

123456789.dkr.ecr.eu-west-1.amazonaws.com/my.registry.com/namespace/alpine

and low and behold pushing to

123456789.dkr.ecr.eu-west-1.amazonaws.com/my.registry.com/namespace/alpine:latest 
The push refers to repository [123456789.dkr.ecr.eu-west-1.amazonaws.com/my.registry.com/namespace/alpine]
0c8667b5b: Pushed
730460948: Pushed
1.0: digest: sha256:e1f814f3818efea45267ebfb4918088a26a18c size: 7

works just fine

Answer 5

The AWS documents tell you to execute the following command (for ap-southeast-2 region)

aws ecr get-login --region ap-southeast-2

When I bumped into this issue, it wasn't clear to me based on that docs that you need to enter the result of this command into the terminal and execute it.

Fix that worked for me to was to copy the result to the clipboard with

aws ecr get-login --region ap-southeast-2 | pbcopy

Paste the result into the command line and execute it

Answer 6

If you use profiles, don't forget to pass --profile=XXX to aws ecr get-login.