boto3 ecr get_authorization_token return incorrect token

Hi, Today I have experienced this issue with boto3 ecr. I used a simple scripts to get token from boto3 to access login docker on 2 machines.

import boto3
from docker import Client
client = boto3.client('ecr', region_name="us-east-1")
response = client.get_authorization_token(
    registryIds=[
        'MY ACCOUNT ID',
    ]
)
print response
token = response["authorizationData"][0]["authorizationToken"]
endpoint = response["authorizationData"][0]["proxyEndpoint"]
cli = Client(base_url='unix://var/run/docker.sock')
cli.login(username="AWS", password=token, registry=endpoint)
print cli

I ran the script on 2 machines with the same full access to ecr role. 2 machines returned same token, however only one machine worked with this token, the other returned 403 Forbidden.

Since I have a cluster of machines using ECR, I need all of them to be able to connect with ECR

[stolati]

The solution : the token returned by boto (in fact aws api) is not the password. It’s a base64 encoded user:password. You should do user, password = base64.b64decode(token).split(':') Hope it will unblock someone.

[mrtj]

For completeness, here’s how to login to an ECR repo with docker-py:

import base64
import boto3
import docker
docker_client = docker.from_env()

def ecr_login(region):
    ecr = boto3.client('ecr', region_name=region)
    resp = ecr.get_authorization_token()
    auth_resp = resp['authorizationData'][0]
    token = auth_resp['authorizationToken']
    registry = auth_resp['proxyEndpoint']
    username, password = base64.b64decode(token).decode('utf-8').split(':')
    docker_client.login(username=username, password=password, registry=registry)