<p>I'm having trouble setting up Spinnaker with ECR access. </p>

<p><strong>Background</strong>: I installed spinnaker using helm on an EKS cluster and I've confirmed that the cluster has the necessary ECR permissions (by manually running ECR commands from within the clouddriver pod).  I am following the instructions here to get Spinnaker+ECR set up: <a href="https://www.spinnaker.io/setup/install/providers/docker-registry/" rel="nofollow noreferrer">https://www.spinnaker.io/setup/install/providers/docker-registry/</a></p>

<p><strong>Issue</strong>: When I run:</p>

<pre><code>hal config provider docker-registry account add my-ecr-registry \
--address $ADDRESS \
--username AWS \
--password-command "aws --region us-west-2 ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d | sed 's/^AWS://'"
</code></pre>

<p>I get the following output:</p>

<pre><code>+ Get current deployment
  Success
- Add the some-ecr-registry account
  Failure
Problems in default.provider.dockerRegistry.some-ecr-registry:
- WARNING Resolved Password was empty, missing dependencies for
  running password command?
- WARNING You have a supplied a username but no password.
! ERROR Unable to fetch tags from the docker repository: code, 400
  Bad Request
? Can the provided user access this repository?
- WARNING None of your supplied repositories contain any tags.
  Spinnaker will not be able to deploy any docker images.
? Push some images to your registry.
Problems in halconfig:
- WARNING There is a newer version of Halyard available (1.28.0),
  please update when possible
? Run 'sudo apt-get update &amp;&amp; sudo apt-get install
  spinnaker-halyard -y' to upgrade
- Failed to add account some-ecr-registry for provider
  dockerRegistry.
</code></pre>

<ul>
<li>I have confirmed that the aws-cli is installed on the clouddriver pod.  And I've confirmed that I can the password-command directly from the clouddriver pod and it successfully returns a token.</li>
<li>I've also confirmed that if I manually generate an ECR token and <code>run hal config provider docker-registry account add my-ecr-registry --address $ADDRESS --username AWS  --password-command "echo $MANUALLY_GENERATED_TOKEN"</code> everything works fine.  So there is something specific to the password-command that is going wrong and I'm not sure how to debug this.   </li>
<li>One other odd behavior: if I simplify the password command to be: <code>hal config provider docker-registry account add some-ecr-registry --address $ADDRESS --username AWS --repositories code --password-command "aws --region us-west-2 ecr get-authorization-token"</code> , I get an addt'l piece of output that says <code>"- WARNING Password command returned non 0 return code stderr/stdout was:bash: aws: command not found"</code>.  This output only appears for this simplified command.</li>
</ul>

<p>Any advice on how to debug this would be much appreciated.  </p>

diego_c
<p>If like me your ECR registry is in another account, then you have to forcibly assume the role  for the target account where your registry resides</p>
<p><code>passwordCommand: read -r AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN &lt;&lt;&lt; `aws sts assume-role  --role-arn arn:aws:iam::&lt;AWS_ACCOUNT&gt;:role/&lt;SPINNAKER ROLE_NAME&gt; --query &quot;[Credentials.AccessKeyId, Credentials.SecretAccessKey, Credentials.SessionToken]&quot;  --output text --role-session-name spinnakerManaged-w2`; export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; aws ecr get-authorization-token --region us-west-2  --output text --query 'authorizationData[].authorizationToken' --registry-ids &lt;AWS_ACCOUNT&gt; | base64 -d | sed 's/^AWS://' </code></p>
<p>Credits to <a href="https://github.com/spinnaker/spinnaker/issues/5374#issuecomment-607468678" rel="nofollow noreferrer">https://github.com/spinnaker/spinnaker/issues/5374#issuecomment-607468678</a></p>
