Home / server / Questions / 1004915
Accepted
Moak
Asked: 2020-02-28 17:51:06 +0800 CST

What is the proper way to log in to ECR?

  • 772

Currently, I have this command in my bash script for building & pushing an image to Amazon ECR

docker login -u AWS -p "$(aws ecr get-login-password)" "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.us-east-1.amazonaws.com"

Which gives the warning "WARNING! Using --password via the CLI is insecure. Use --password-stdin."

How can I change this command to not give the warning? Is this really insecure?

aws-cli amazon-ecr

4 Answers

  1. Best Answer

    Tinkering around this seems to work well:

    aws ecr get-login-password | docker login -u AWS --password-stdin "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.us-east-1.amazonaws.com"
    • 5 
  2. $(aws ecr get-login --no-include-email --region cn-northwest-1)

    replace cn-northwest-1 as your region.

    • 2

  3. The recommended way to log in to ECR is to use the command produced by aws ecr get-login.

    • 1

  4. Assuming the AWS CLI is already configured correctly, for example with:

    aws configure

    Then just call the following:

    aws ecr get-login-password | docker login -u AWS --password-stdin "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.$(aws configure get region).amazonaws.com"

    The previous command aws ecr get-login automatically resolved the Account ID and region. The above command does that explicitly:

    $(aws sts get-caller-identity --query 'Account' --output text)

    (as per @Moak's answer, thank you)

    and:

    $(aws configure get region)

    to get the region.

    • 0