Login doesn't support using EC2 instance credentials with ECR login

Behaviour

I am using self-hosted runners with an IAM role attached (with ECR permissions) and the login action fails.

Steps to reproduce this issue

1. Create a self hosted runner with IAM role attached (with ECR permissions)
2. Create a workflow with uses: docker/login-action@v1
3. Try to run the workflow

Expected behaviour

The login should use the EC2 instance credentials and login to ECR.

Actual behaviour

The login action fails

Error: An error occurred (UnrecognizedClientException) when calling the GetAuthorizationToken operation: The security token included in the request is invalid.

IMO the action should not attempt to overwrite the env vars for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in this case.

I can make it work using this manual run step:

- name: ECR login
  run: |
    aws ecr get-login-password | docker login --username AWS --password-stdin <aws-account-id>.dkr.ecr.<aws-region>.amazonaws.com

Configuration

• Repository URL (if public): private
• Build URL (if public): private

- name: ECR login
  uses: docker/login-action@v1
  with:
    registry: <aws-account-id>.dkr.ecr.<aws-region>.amazonaws.com

Logs

Sorry private repo, I can’t share the logs.

[Flydiverny]

I did some testing to simulate what happens in the login-action

Given this step below I will get the expected output (running on a self-hosted runner)

      - uses: actions/github-script@v5
        with:
          script: |
            await exec.getExecOutput(await io.which('aws', true), ['sts', 'get-caller-identity'])
          result-encoding: string

{
    "UserId": "REDACTED:i-REDACTED",
    "Account": "REDACTED",
    "Arn": "arn:aws:sts::REDACTED:assumed-role/REDACTED/i-REDACTED"
}

Where as if I added the process.env vars as the login-action does here the step fails

      - uses: actions/github-script@v5
        with:
          script: |
            let username = ''
            let password = ''
            process.env.AWS_ACCESS_KEY_ID = username || process.env.AWS_ACCESS_KEY_ID;
            process.env.AWS_SECRET_ACCESS_KEY = password || process.env.AWS_SECRET_ACCESS_KEY;
            await exec.getExecOutput(await io.which('aws', true), ['sts', 'get-caller-identity'])
          result-encoding: string

An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.
Error: Unhandled error: Error: The process '/usr/local/bin/aws' failed with exit code 254

a simple change to how we set the env vars should resolve it

      - uses: actions/github-script@v5
        with:
          script: |
            let username = ''
            let password = ''
            if (username) {
              process.env.AWS_ACCESS_KEY_ID = username;
            }
            if (password) {
              process.env.AWS_SECRET_ACCESS_KEY = password;
            }
            await exec.getExecOutput(await io.which('aws', true), ['sts', 'get-caller-identity'])
          result-encoding: string

Which will get me my EC2 credentials again 😃

Created a PR #114

[nitrocode]

I’m running into the same issue.

@crazy-max

Can you give me the complete output of the action please? Some logs are missing (like AWS cli version used). Also looking at the error it looks like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars are wrong or not propagated to the action on your self-hosted runner.

If the self hosted running is using an IAM role then these environment variables would not be set as the EC2 should reuse the IAM role for authentication, no ?