GitHub Actions aws-actions/amazon-ecr-login Fails to Authenticate

By Daniel Zoghalchali·Latchkey

amazon-ecr-login could not obtain an ECR auth token. Usually no AWS credentials were configured in the job, or the role lacks ecr:GetAuthorizationToken; occasionally the ECR endpoint is briefly unreachable.

What this error means

The ecr-login step fails with an access-denied or credentials error, or a later docker push fails with "no basic auth credentials" because login never succeeded.

Error: User: arn:aws:sts::...:assumed-role/... is not authorized to perform:
ecr:GetAuthorizationToken

Common causes

No AWS credentials configured in the job

amazon-ecr-login needs AWS credentials in the environment, normally from a prior aws-actions/configure-aws-credentials step. Without them it cannot call ECR.

Role lacks ECR permissions

The assumed role must allow ecr:GetAuthorizationToken (and push/pull actions). Missing IAM permissions fail the login with access denied.

How to fix it

Configure credentials, then log in

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/ci-ecr
    aws-region: us-east-1
- uses: aws-actions/amazon-ecr-login@v2

Grant ECR permissions and retry blips

1. Allow ecr:GetAuthorizationToken plus the push/pull actions on the role.
2. Confirm the aws-region matches the registry region.
3. Re-run if the failure is a transient ECR endpoint/network error rather than access-denied.

How to prevent it

• Always run configure-aws-credentials before amazon-ecr-login.
• Scope the CI role to the exact ECR actions it needs.
• Retry transient ECR endpoint errors; fix IAM for access-denied.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions