ECR Buildkite Plugin

A Buildkite plugin to login to an ECR repository before running a build step.

This will use standard AWS credentials available in the environment, or as an instance role or task role as available. These must be granted appropriate permissions for login to succeed and for push and pull to operate.

Example

This will login docker to ECR prior to running your script.

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.7.0:
          login: true

If you want to log in to ECR on another account:

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.7.0:
          login: true
          account_ids: "0015615400570"
          region: "ap-southeast-2"

If you need to assume a role to perform that login:

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.7.0:
          login: true
          account-ids: "0015615400570"
          region: "ap-southeast-2"
          assume_role:
            role_arn: "arn:aws:iam::0015615400570:role/demo"

Options

login

Whether to login to your account's ECR.

account-ids (optional)

Either a string, or a list of strings with AWS account IDs that correspond to the Amazon ECR registries that you want to log in to. Make sure to quote these if they start with a 0.

You can use the literal public.ecr.aws as a value to authenticate against AWS ECR public registries.

⚠️ If you are using ECR Credential Helper in your docker configuration it is possible you have to add https:// to your account IDs to prevent an error (see the corresponding bug report for more information).

no-include-email (optional)

Obsolete if using AWS CLI version 1.17.10 or newer.

Add --no-include-email to ecr get-login. Required for docker 17.06+, but needs aws-cli 1.11.91+.

region (optional)

Set a specific region for ECR, defaults to AWS_DEFAULT_REGION on the agent, or us-east-1 if none specified.

retries (optional)

Retries login after a delay N times. Defaults to 0.

assume-role (optional)

Updates AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

Assume an AWS IAM role before ECR login. Supports role-arn and duration-seconds (optional) per the associated AWS CLI command.

profile (optional)

Requires AWS CLI version 1.17.10 or greater.

Use a different AWS profile from the default during ECR login.

License

MIT (see LICENSE)