Bitbucket pipeline failed when login to docker

[Jameesh Moidunny]

Hi My bitbucket pipeline fails when i try to push docker image to ECR through bitbucket pipeline 

step: &f-ecr-release

        name: 'Frontend image ECR'

        image: tstrohmeier/awscli:3.8.3

        services:

          - docker

        caches:

          - pip

        script:

          # aws login

          - aws configure set default.region us-east-1

          #- aws configure set aws_access_key_id $AWS_KEY

          #- aws configure set aws_secret_access_key $AWS_SECRET

          - aws configure set aws_access_key_id "${AWS_ACCESS_KEY}"

          - aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"

          - eval $(aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin *********.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com | sed 's;https://;;g')

          # docker

          - cd frontend

          - cp .env.e2e /.env

          - export BUILD_ID=$BITBUCKET_BRANCH_$BITBUCKET_COMMIT_$BITBUCKET_BUILD_NUMBER

          - echo $BUILD_ID

          - docker build -t nspire-frontend .

          - docker tag nspire-frontend:latest *******.dkr.ecr.us-east-1.amazonaws.com/nspire-frontend:latest

          - docker push *******.dkr.ecr.us-east-1.amazonaws.com/nspire-frontend:latest

Error was 

+ eval $(aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin 199428173682.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com | sed 's;https://;;g')
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

bash: Login: command not found

if I takeout docker login part it fails when push and says 

no basic auth credentials

[Patrik S]

Hello @Jameesh Moidunny ,

Welcome to Atlassian Community!

The issue here seems to be that the aws cli command get-login-password directly output the password to be used in the docker login, so you don't have to use the command within an eval$(). You can just pipe the output of the command to docker login, as below :

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

Source: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/get-login-password.html

You would just need the eval$() command if you were using get-login, which is previous version of the aws cli command to get the credentials. The get-login function would return a docker login string containing the token, and this is the reason it would need to be used along with eval$()

Source: https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html

Another option I would like to share is that you can use the pipe atlassian/aws-ecr-push-image to push the image you are building to your ECR registry. Please find below an example YML file using that pipe :

script:
  # build the image
  - docker build -t my-docker-image .

  # use the pipe to push the image to AWS ECR
  - pipe: atlassian/aws-ecr-push-image:1.5.0
    variables:
      AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
      AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
      AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
      IMAGE_NAME: my-docker-image

You can refer to the following documentation for more details about atlassian/aws-ecr-push-image pipe and how it can be configured :

• https://bitbucket.org/product/features/pipelines/integrations?p=atlassian/aws-ecr-push-image

Hope that helps! Let me know in case you have any further questions related to this topic.

Thank you @Jameesh Moidunny ,

Kind regards,

Patrik S