<p>I use this script in gitlab-ci.yml</p>

<pre><code>image: docker:19.03
services:
- docker:19.03.0-dind
before_script:
- $(aws ecr get-login --no-include-email --region eu-central-1)
</code></pre>

<p>... and provide AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY variables into Settings/CI-CD section. 
Ensure your region with images is the same where are you logging in. </p>

CC BY-SA 4.0
2020-02-28T15:17:26.267Z
2020-02-28T15:17:26.267Z
Vasiliy  Shakhunov
<p>This script can be used as a bootstrap script to register private Gitlab runner and configure runner to access AWS ECR. You can use Ubuntu 18 LTS AMI and launch AWS EC2 instance to host the Gitlab runner.</p>

<p>Attach AWS IAM role to grant EC2 instance to access AWS ECR and push-pull docker images. Also, awscli AWS configure command can be used or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variable.</p>

<p>Need to export GITLAB_RUNNER_TOKEN and AWS_REGION as variable to run the script successfully.</p>

<pre><code>#!/bin/bash
set -e
apt update -y &amp;&amp; apt install awscli make -y
curl -LJO https://gitlab-runner-downloads.s3.amazonaws.com/latest/deb/gitlab-runner_amd64.deb
dpkg -i gitlab-runner_amd64.deb
sed -i -e '/volumes/s/\["\/cache\"]/\["\/cache","\/var\/run\/docker.sock:\/var\/run\/docker.sock"]/' /etc/gitlab-runner/config.toml
curl -fsSL https://get.docker.com -o get-docker.sh &amp;&amp; sh get-docker.sh &amp;&amp; usermod -aG docker gitlab-runner
gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.com/" \
  --registration-token "${GITLAB_RUNNER_TOKEN}" \
  --executor "docker" \
  --docker-image "docker:latest" \
  --description "gitlab-runner" \
  --tag-list "gitlab,runner,aws" \
  --run-untagged="true" \
  --locked="false" \
  --access-level="not_protected"
echo -e "export AWS_SDK_LOAD_CONFIG=true \nexport AWS_REGION=${AWS_REGION}" &gt;&gt; ~/.bashrc
source ~/.bashrc &amp;&amp; mkdir ~/.docker
cat &lt;&lt;EOF &gt;&gt;~/.docker/config.json
{
  "credsStore": "ecr-login"
}
EOF
git clone https://github.com/awslabs/amazon-ecr-credential-helper.git
cd amazon-ecr-credential-helper/ &amp;&amp; make docker
cp bin/local/docker-credential-ecr-login /usr/local/bin/
systemctl restart docker  &amp;&amp; gitlab-runner restart
export AWS_REGION=${AWS_REGION} &amp;&amp; docker-credential-ecr-login list
</code></pre>

CC BY-SA 4.0
2020-01-29T07:34:12.173Z
2020-01-29T07:34:12.173Z
Piyush Sonigra
<p>GitLab and GitLab runners are running on the same host (I know how bad it is). There is an IAM Role attached to the EC2 on which GitLab is running.</p>

<p>This IAM Role gives the permission to perform some actions on multi-account ECR's.</p>

<p>Runners use docker as executor and assume role perfectly to push,pull images.
But, if images need to be pulled/pushed to the account on which GitLab is running, it doesn't work. I first need to pull images on the GitLab host so they are accessible within the runners.</p>

<p>I did a small test: I manually started a container directly on the GitLab host and ran <code>aws ecr get-login...</code> and I was able to login on the account.</p>

<p>I've installed amazon-ecr-credential-helper and configured like stated in the doc.</p>

<p>I don't understand why runners cannot pull images from the account...</p>

CC BY-SA 4.0
2019-09-20T15:31:31.880Z
When you started the container and did your test were you running the command in the container or on the GitLab host?
Wesley Rolnick
CC BY-SA 4.0
2019-09-20T15:34:54.193Z
In the container directly. I didn't try to pull directly w/o login first
Kaymaz
<docker><gitlab-ci-runner><aws-ecr>
GitLab runner not able to fetch AWS ECR images in the current AWS account
Kaymaz
# GitLab runner not able to fetch AWS ECR images in the current AWS account

(Asked by: username_0 on 2019-09-20)

GitLab and GitLab runners are running on the same host (I know how bad it is). There is an IAM Role attached to the EC2 on which GitLab is running.

This IAM Role gives the permission to perform some actions on multi-account ECR's.

Runners use docker as executor and assume role perfectly to push,pull images.
But, if images need to be pulled/pushed to the account on which GitLab is running, it doesn't work. I first need to pull images on the GitLab host so they are accessible within the runners.

I did a small test: I manually started a container directly on the GitLab host and ran `aws ecr get-login...` and I was able to login on the account.

I've installed amazon-ecr-credential-helper and configured like stated in the doc.

I don't understand why runners cannot pull images from the account...

**Tags:** docker, gitlab-ci-runner, aws-ecr

> **Comments:**
> **username_1**: When you started the container and did your test were you running the command in the container or on the GitLab host?  
> **username_0**: In the container directly. I didn't try to pull directly w/o login first  

---

## 2 answers

### Answer by username_2 on 2020-02-28. Score: 1

I use this script in gitlab-ci.yml
image: docker:19.03
services:
- docker:19.03.0-dind
before_script:
- $(aws ecr get-login --no-include-email --region eu-central-1)

... and provide AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY variables into Settings/CI-CD section. 
Ensure your region with images is the same where are you logging in.


---

### Answer by username_3 on 2020-01-29. Score: 0

This script can be used as a bootstrap script to register private Gitlab runner and configure runner to access AWS ECR. You can use Ubuntu 18 LTS AMI and launch AWS EC2 instance to host the Gitlab runner.
Attach AWS IAM role to grant EC2 instance to access AWS ECR and push-pull docker images. Also, awscli AWS configure command can be used or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variable.
Need to export GITLAB_RUNNER_TOKEN and AWS_REGION as variable to run the script successfully.
#!/bin/bash
set -e
apt update -y && apt install awscli make -y
curl -LJO https://gitlab-runner-downloads.s3.amazonaws.com/latest/deb/gitlab-runner_amd64.deb
dpkg -i gitlab-runner_amd64.deb
sed -i -e '/volumes/s/\["\/cache\"]/\["\/cache","\/var\/run\/docker.sock:\/var\/run\/docker.sock"]/' /etc/gitlab-runner/config.toml
curl -fsSL https://get.docker.com -o get-docker.sh && sh get-docker.sh && usermod -aG docker gitlab-runner
gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.com/" \
  --registration-token "${GITLAB_RUNNER_TOKEN}" \
  --executor "docker" \
  --docker-image "docker:latest" \
  --description "gitlab-runner" \
  --tag-list "gitlab,runner,aws" \
  --run-untagged="true" \
  --locked="false" \
  --access-level="not_protected"
echo -e "export AWS_SDK_LOAD_CONFIG=true \nexport AWS_REGION=${AWS_REGION}" >> ~/.bashrc
source ~/.bashrc && mkdir ~/.docker
cat <>~/.docker/config.json
{
  "credsStore": "ecr-login"
}
EOF
git clone https://github.com/awslabs/amazon-ecr-credential-helper.git
cd amazon-ecr-credential-helper/ && make docker
cp bin/local/docker-credential-ecr-login /usr/local/bin/
systemctl restart docker  && gitlab-runner restart
export AWS_REGION=${AWS_REGION} && docker-credential-ecr-login list


---

