AWS CLI v2 authentication to ECR

Environment:

• Jib version: 2.7.1
• Build tool: Gradle 6.7.1
• OS: Ubuntu 20.04

Description of the issue:

I have updated AWS CodeBuild image to Ubuntu 20.04 which ships with AWS CLI version 2. The new AWS CLI has changed ECR login and I cannot authenticate Jib build now.

Expected behavior:

Previously, I could authenticate the Jib to ECR by $(aws ecr get-login -no-include-email) and then call ./gradlew jib.

It has been deprecated now and recommended method is:

aws ecr get-login-password | docker login --username AWS --password-stdin MY-REGISTRY-URL (source)

How do I reproduce --password-stdin in Jib environment?

Thank you

[jakubgruber]

I have resolved the issue by rewriting the CI/CD pipeline. Your stackoverflow comment helped me a lot to understand how the authentication works.

AWS CLI v1:

$(aws ecr get-login --region $AWS_DEFAULT_REGION --no-include-email)
chmod +x ./gradlew
./gradlew jib --image=$ECR_REPO_URI:$IMAGE_TAG

AWS CLI v2:

JIB_ECR_USERNAME=AWS
JIB_ECR_PASSWORD=$(aws ecr get-login-password --region $AWS_DEFAULT_REGION)
chmod +x ./gradlew
./gradlew jib --image=$ECR_REPO_URI:$IMAGE_TAG -Djib.to.auth.username=$JIB_ECR_USERNAME -Djib.to.auth.password=$JIB_ECR_PASSWORD

Hopefully, someone will find this usefull.

[chanseokoh]

Thanks for the update. Very interesting. Just one thing, since you are passing the credentials on the command line, you may want to make sure that the command (hence the username and password) is not logged or stored in a shell history. You can easily eliminate the risk in Gradle, e.g., if you set jib.to.auth.username = System.getenv('JIB_ECR_USERNAME') in build.gradle.

However, the following is supposed to just work. With the right MY-REGISTRY-URL (should be the host[:port] portion of $ECR_REPO_URI), it does docker login, which will store the credentials for the registry into ~/.docker/config.json. Then Jib should be able to pick up the credentials for MY-REGISTRY-URL.

aws ecr get-login-password | docker login --username AWS --password-stdin MY-REGISTRY-URL