gitlab ci - How do I log into AWS before pulling image from ECR?

Question

I'm pulling image into my pipeline from ECR. First I need to authenticate using eval $(aws ecr get-login --region eu-west-2 --no-include-email | sed 's|https://||')

however I don't have an idea how to use it within CI workflow since this should run before the image is pulled:

e2e:
  stage: test
  image: 2xxxxxxxxxxxxx8.dkr.ecr.eu-west-2.amazonaws.com/training-users_db
  services:
   - postgres:12.2-alpine
  variables:
    AWS_ACCOUNT_ID: $AWS_ACCOUNT_ID
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_KEY: $AWS_SECRET_ACCESS_KEY
    POSTGRES_DB: users
    POSTGRES_USER: postgres
    POSTGRES_PASSWORD: postgres
    DATABASE_TEST_URL: postgres://postgres:postgres@postgres:5432/users
    FLASK_ENV: development
    SECRET_KEY: $SECRET_KEY
  script:
    - eval $(aws ecr get-login --region eu-west-2 --no-include-email | sed 's|https://||')

How can I log into ECR right before the image is pulled ?

Answer 1

This is the closest I've found for documentation on this: https://mherman.org/blog/gitlab-ci-private-docker-registry/ But I haven't been able to get it to work as described yet. I still get some authentication errors when it tries to pull my image. I have a support ticket open to try and figure it out, but maybe you can get it working?