Can't push image to Amazon ECR - fails with “n

Question

I'm trying to push a docker image to an Amazon ECR registry. I'm using docker client Docker version 1.9.1, build a34a1d5. I use "aws ecr get-login --region us-east-1" to get the docker login creds. I then successfully login with those creds as follows:

docker login -u AWS -p XXXX -e none https://####.dkr.ecr.us-east-1.amazonaws.com
WARNING: login credentials saved in /Users/ar/.docker/config.json
Login Succeeded

But when I try to push my image I get the following error:

$ docker push ####.dkr.ecr.us-east-1.amazonaws.com/image:latest
The push refers to a repository [####.dkr.ecr.us-east-1.amazonaws.com/image] (len: 1)
bcff5e7e3c7c: Preparing 
Post https://####.dkr.ecr.us-east-1.amazonaws.com/v2/image/blobs/uploads/: no basic auth credentials

I made sure that the aws user had the correct permissions. I also made sure that the repository allowed that user to push to it. Just to make sure that wasn't an issue I set the registry to allow all users full access. Nothing changes the "no basic auth credentials" error. I don't know how to begin to debug this since all the traffic is encrypted.

UPDATE

So I had a bit of Homer Simpson D'Oh moment when I realized the root cause of my problem. I have access to multiple AWS accounts. Even though I was using aws configure to set my credentials for the account where I had setup my repository the aws cli was actually using the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. So when I did aws ecr get-login it was returning a login for the wrong account. I failed to notice that the account numbers were different until I just went back now to try some of the proposed answers. When I remove the environment variables everything works correctly. I guess the motto of the story is if you hit this error, make sure that the repository you are logging into matches the tag you have applied to the image.

Answer 1

The AWS documents tell you to execute the following command (for ap-southeast-2 region)

aws ecr get-login --region ap-southeast-2

When I bumped into this issue, it wasn't clear to me based on that docs that you need to enter the result of this command into the terminal and execute it.

Fix that worked for me to was to copy the result to the clipboard with

aws ecr get-login --region ap-southeast-2 | pbcopy

Paste the result into the command line and execute it

Answer 2

My issue was having multiple AWS credentials; default and dev. Since I was trying to deploy to dev this worked:

$(aws ecr get-login --no-include-email --region eu-west-1 --profile dev | sed 's|https://||')

Answer 3

That error message is coming from docker and it not necessarily related to AWS as I have gotten same error when not using AWS ... its just saying docker is not getting authorization to proceed from whatever source of auth it happens to be using

In my case, in test I removed directory ~/.docker and got that error ... after I bounced my local docker registry then docker push was fine

Answer 4

In my case this was a bug with Docker for Windows and their support for the Windows Credential Manager.

Open your ~/.docker/config.json and remove the "credsStore": "wincred" entry.

This will cause credentials to be written to the config.json directly. You'll have to log in again afterwards.

You can track this bug through the tickets #22910 and #24968 on GitHub.

Answer 5

Try with:

eval $(aws ecr get-login --no-include-email | sed 's|https://||')

before push.

Answer 6

You have to make sure you have logged in using correct credentials, See the offical error description and checks here

http://docs.aws.amazon.com/AmazonECR/latest/userguide/common-errors-docker.html

Fixing "no basic authentication" is described in the link