Error: pull access denied or repository does not exist (ECR login required)

Workarounds

1. 95% success Login to ECR: aws ecr get-login-password | docker login --username AWS --password-stdin <account>.dkr.ecr.<region>.amazonaws.com

   aws ecr get-login-password | docker login --username AWS --password-stdin

   Sources: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html

2. 88% success For Kubernetes, create an ECR pull secret or use IRSA for EKS

   # Create ECR pull secret:
   kubectl create secret docker-registry ecr-secret \
     --docker-server=ACCOUNT.dkr.ecr.REGION.amazonaws.com \
     --docker-username=AWS \
     --docker-password=$(aws ecr get-login-password)
   
   # Or for EKS with IRSA (recommended), annotate the service account:
   kubectl annotate serviceaccount default eks.amazonaws.com/role-arn=arn:aws:iam::ACCOUNT:role/ecr-pull-role
   
   # Reference in pod spec: imagePullSecrets: [{name: ecr-secret}]

   Sources: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html

3. 85% success Add ECR login to CI/CD pipeline — token expires every 12 hours

   # GitHub Actions example:
   - name: Login to Amazon ECR
     uses: aws-actions/amazon-ecr-login@v2
   
   # GitLab CI example:
   before_script:
     - aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY
   
   # The token is valid for 12 hours, so always login at the start of each pipeline run.

   Sources: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html