Understanding repository authentication
As we discussed, ECR repositories can be private or public, and the security credentials you use to access these repositories will vary depending on the type of repository you create.
Accessing ECR private repositories
Access to private repositories is controlled through AWS IAM and repository permissions. If you are using the native AWS API, then you can use the standard Signature Version 4 signing process used by API clients such as the AWS CLI or the Python boto3 library.
In this chapter, we will use Docker commands to interact with the ECR repository, so we need to convert the AWS access and secret keys into something Docker will understand. This is done with the aws ecr get-login-password command and passing the output into the docker login command. An example is shown next:
$ aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin 1122334.dkr.ecr.eu-central-1.amazonaws.com/myapp WARNING...
