Cloud
ECR URI Builder
Build an ECR image URI and its push sequence, with the right DNS suffix for each AWS partition.
Registry
Image URI
123456789012.dkr.ecr.eu-central-1.amazonaws.com/my-app:1.0.0- Registry
123456789012.dkr.ecr.eu-central-1.amazonaws.com- ARN
arn:aws:ecr:eu-central-1:123456789012:repository/my-app
Push sequence
aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-central-1.amazonaws.com
docker build -t my-app:1.0.0 .
docker tag my-app:1.0.0 123456789012.dkr.ecr.eu-central-1.amazonaws.com/my-app:1.0.0
docker push 123456789012.dkr.ecr.eu-central-1.amazonaws.com/my-app:1.0.0- The login token expires after 12 hours. In CI, run get-login-password as part of the job rather than storing the token.
Kubernetes reference
containers:
- name: app
image: 123456789012.dkr.ecr.eu-central-1.amazonaws.com/my-app:1.0.0A node with an instance role that permits ecr:GetAuthorizationToken and ecr:BatchGetImage needs no imagePullSecret — the kubelet's ECR credential provider handles it.