title: GetAuthorizationToken permission error in AWS CodeBuild
body: <p>I'm trying to setup my Node project with AWS CodeBuild. </p>
  
  <pre><code>version: 0.2
  phases:
  
    pre_build:
      commands:
        - $(aws ecr get-login)
        - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
  
    build:
      commands:
        - docker build -t "${REPOSITORY}:${TAG}" .
  
    post_build:
      commands:
        - docker push "${REPOSITORY}:${TAG}"
  </code></pre>
  
  <p>When I trigger a build, command <code>$(aws ecr get-login)</code> fails:</p>
  
  <blockquote>
    <p>An error occurred (AccessDeniedException) when calling the
    GetAuthorizationToken operation: User is not authorized to perform: ecr:GetAuthorizationToken on resource: *
    [Container] 2018/10/26 10:04:12 Command did not exit successfully
    $(aws ecr get-login) exit status 255</p>
  </blockquote>
  
  <p>In IAM console, the user has these policies attached:</p>
  
  <ul>
  <li>AmazonEC2ContainerRegistryFullAccess</li>
  <li>AmazonEC2ContainerRegistryPowerUser </li>
  </ul>
  
  <p>and both contain <code>ecr:GetAuthorizationToken</code> permission.</p>
  
  <p>What am I missing?</p>