aws-actions/amazon-ecr-login "no basic auth credentials"

By Kaveh Alemi·Latchkey

amazon-ecr-login authenticates Docker to ECR using AWS credentials in the environment. Without a prior configure-aws-credentials step (or with an unauthorized role), the docker push has no registry auth.

What this error means

A docker push to ECR fails with "no basic auth credentials" after the ecr-login step.

denied: Your authorization token has expired. Reauthenticate and try again.
no basic auth credentials
##[error]Process completed with exit code 1.

Common causes

No AWS credentials configured

configure-aws-credentials did not run, so ecr-login cannot obtain an ECR token.

Role lacks ecr permissions

The assumed role cannot call ecr:GetAuthorizationToken, so the login produces no usable auth.

Transient ECR endpoint error

A momentary network or 5xx from the ECR endpoint can drop the auth token.

How to fix it

Configure AWS credentials before ecr-login

1. Add aws-actions/configure-aws-credentials with OIDC or keys and a region.
2. Ensure the role allows ecr:GetAuthorizationToken and push.
3. Run ecr-login, then docker push.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::111122223333:role/ci
    aws-region: us-east-1
- uses: aws-actions/amazon-ecr-login@v2

How to prevent it

• Always run configure-aws-credentials (with a region) before ecr-login.
• Scope the CI role to the exact ECR push permissions it needs.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions