Copilot Setup Steps docker ECR login

[razvanz]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

General

Discussion Details

Hi!

I've set up a Copilot Setup Steps workflow as per the docs, in which I perform a docker ECR login.

name: "Copilot Setup Steps"
on:
  workflow_dispatch:
env:
  AWS_REGION: ${{ secrets.AWS_REGION != '' && secrets.AWS_REGION || 'us-east-1' }}
jobs:
  copilot-setup-steps:
    runs-on: [ backend-jvm-ss ]
    environment: copilot
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1 # We only need the latest version of the code.
      - uses: aws-actions/configure-aws-credentials@v5
        with:
          aws-region: ${{ secrets.AWS_REGION != '' && secrets.AWS_REGION || 'us-east-1' }}
          mask-aws-account-id: 'false'
      - uses: aws-actions/amazon-ecr-login@v2

This however does not seem to work as I can see in the log:

Error response from daemon: failed to resolve reference "<masked>.dkr.ecr.eu-west-1.amazonaws.com/hashicorp/terraform-plugins-cached:1.3.7": pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials

How am I supposed to do it?

[sahilbhat1]

Hi @razvanz,
I see the issue! It looks like a Region Mismatch between your login step and the image you are trying to pull.
The Problem:
In your workflow, you have a fallback to us-east-1 if the secret is missing:
aws-region: ${{ secrets.AWS_REGION != '' && secrets.AWS_REGION || 'us-east-1' }}
However, the error message shows you are trying to pull from eu-west-1:
...dkr.ecr.eu-west-1.amazonaws.com/...
ECR login is region-specific. If your workflow defaults to logging into us-east-1, your Docker client will not have the credentials to pull images from eu-west-1, resulting in the "no basic auth credentials" error.
The Fix:
Ensure your amazon-ecr-login step is targeting the same region as your registry. You can force the region in the login step to be safe: - uses: aws-actions/amazon-ecr-login@v2 with: # Force the login to match the registry region in your error message region: eu-west-1 Also, check your Permissions:
If you are using OIDC (OpenID Connect) for AWS authentication, you explicitly set permissions: contents: read, which overwrites the default permissions. You likely need to add id-token: write for the credentials action to work: permissions: contents: read id-token: write # Required if you use OIDC. Hope this gets your workflow running!