title: Deploy image from EC2 Container Registry to Elastic Beanstalk credentials?
body: <p>Given the setup of:</p>
  
  <ul>
  <li>Application developed locally and pushed to an <a href="https://aws.amazon.com/ecr/" rel="nofollow">EC2 Container Registry</a> private registry</li>
  <li>An <a href="https://aws.amazon.com/elasticbeanstalk/" rel="nofollow">Elastic Beanstalk</a> environment set with a Docker host</li>
  </ul>
  
  <p>In order to deploy my application, the Elastic Beanstalk <a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker_image.html" rel="nofollow">single container guide</a> says to make a <code>Dockerrun.aws.json</code> file.</p>
  
  <p>The Elastic Beanstalk guide <a href="http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker.container.console.html#docker-images-private" rel="nofollow">also says</a> that to use images from (any) private repository, there needs to be a credentials file (with authentication token and email address) added to an S3 bucket.</p>
  
  <p>Authentication <a href="http://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html" rel="nofollow">to the EC2 Container Registry</a> involves querying for a token that the <code>docker login</code> command can use, <strong><em>but it's only valid for 12 hours</em></strong>.</p>
  
  <p>So, in theory, I can follow the Elastic Beanstalk guide, and use the <code>aws ecr get-login</code>, <code>docker login ...</code> command to get Docker to create the config file I need, convert that to a <code>.dockercfg</code> file and put it on S3.</p>
  
  <p>If I then upload my <code>Dockerrun.aws.json</code> file as a new application version to Elastic Beanstalk, I can deploy it right then, if 12 hours haven't elapsed.</p>
  
  <p>My concern is what happens after those 12 hours? If Elastic Beanstalk needs to auto-scale my application and spin up more instances, if it tries to use that S3-stored credential it will fail. Or if I realize I need to roll back to a previous version of my application, I can't just do that through the Elastic Beanstalk list of past application versions; I need to be on a machine with the AWS CLI installed and do the <code>aws ecr get-login</code>, <code>docker login ...</code>, upload to S3 dance again?</p>
  
  <p>Is there a less fragile way to set up the authentication between Elastic Beanstalk and the EC2 Container Registry such that the 12-hour timeout isn't an issue?</p>