Question

A development team uses AWS CodePipeline with AWS CodeBuild to build a containerized microservice. The buildspec.yml must authenticate to Amazon ECR, build the Docker image, tag it, and push it so a later CodeDeploy stage can reference the image. During builds, the push step fails with an authentication error even though the CodeBuild service role has ECR permissions. What should the team add to the buildspec.yml to correctly authenticate Docker to the private ECR registry before pushing?

Accepted Answer

Run 'aws ecr get-login-password' and pipe the output to 'docker login --username AWS --password-stdin' against the registry URI in the pre_build phase

Answer

Store long-lived ECR access keys in the buildspec environment variables and pass them to 'docker login'

Answer

Add the ECR registry credentials to a Docker Hub secret in Secrets Manager and reference it in the build phase

Answer

Enable privileged mode in the CodeBuild project and rely on it to automatically authenticate Docker to ECR