{"id":"21c13e1d-8e21-4933-b3ef-e3ad7abd5a88","task":"Authenticate Docker to a private AWS ECR registry and push a local image","domain":"aws.amazon.com","steps":["Get account ID if unknown: aws sts get-caller-identity --query Account --output text","Authenticate Docker to the registry (token is base64, decoded via get-login-password): aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com","The repository must exist before pushing (unless a repository creation template is configured) — create it first: aws ecr create-repository --repository-name my-repository --region <region>","Optionally set immutable tags at creation time so re-pushing an existing tag fails instead of overwriting: aws ecr create-repository --repository-name my-repository --image-tag-mutability IMMUTABLE --region <region>","Identify the local image to push: docker images","Tag the local image with the full ECR registry URI (format: aws_account_id.dkr.ecr.region.amazonaws.com/repository:tag): docker tag <IMAGE_ID> <aws_account_id>.dkr.ecr.<region>.amazonaws.com/my-repository:tag","Push the tagged image: docker push <aws_account_id>.dkr.ecr.<region>.amazonaws.com/my-repository:tag","Re-run the get-login-password | docker login step whenever the token expires — authorization tokens are valid for 12 hours regardless of IAM principal","Grant the pushing principal an IAM policy including ecr:GetAuthorizationToken (Resource \"*\") plus ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:BatchCheckLayerAvailability, ecr:PutImage, ecr:BatchGetImage scoped to the repository ARN (arn:aws:ecr:<region>:<account_id>:repository/<repository-name>)","Docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html ; https://docs.aws.amazon.com/AmazonECR/latest/userguide/docker-push-ecr-image.html ; https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-push-iam.html ; https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html"],"gotchas":["ECR authorization tokens are valid for exactly 12 hours; after expiry, docker login/push fails and you must re-run 'aws ecr get-login-password | docker login' to get a fresh token — there is no way to extend a token's lifetime.","The repository must already exist in the target registry before 'docker push' will succeed, unless a repository creation template is defined for that prefix; ECR does not auto-create arbitrary repositories.","docker login to ECR requires the literal username 'AWS' (not your IAM user/role name) with the decoded token piped via --password-stdin; using the wrong username or forgetting --password-stdin causes authentication failures.","If the pushing IAM principal lacks ecr:GetAuthorizationToken (which must be granted with Resource \"*\", not scoped to a repository ARN), authentication fails even if repository-level permissions are otherwise correct.","The registry URI must match the --region used to fetch the token and create the repository; a region mismatch between the login target and the repository's actual region causes authentication or 'repository does not exist' errors.","If authenticating to multiple ECR registries (e.g. different accounts), the get-login-password/docker login command must be repeated once per registry URI — one token/login does not cover multiple registries.","When a repository has IMMUTABLE tag mutability set, pushing an image using a tag that already exists returns an ImageTagAlreadyExistsException instead of overwriting the tag; you must push a new tag or configure tag exclusion filters."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T16:21:32.844Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T16:21:32.844Z"},"url":"https://mcp.waymark.network/r/21c13e1d-8e21-4933-b3ef-e3ad7abd5a88"}