AWS ECR: no basic auth credentials / authorization token expired

CI pipeline started failing after running fine for weeks:

Error response from daemon: pull access denied for 123456789.dkr.ecr.us-east-1.amazonaws.com/my-app,
repository does not exist or may require 'docker login'

Or sometimes:

Error: no basic auth credentials

Root cause:

ECR authentication tokens from aws ecr get-login-password expire after 12 hours. The CI runner's docker credentials (cached from the last docker login) had expired.

Fix — always refresh the token before pulling/pushing:

bash

# Add this step BEFORE any docker pull/push in your pipeline
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  123456789.dkr.ecr.us-east-1.amazonaws.com

In GitHub Actions:

yaml

- name: Login to Amazon ECR
  uses: aws-actions/amazon-ecr-login@v2
  # This action automatically handles token refresh

In Kubernetes (for pulling private ECR images):

ECR tokens expire every 12 hours but Kubernetes image pull secrets are static. Use ECR Credential Helper or a refresher controller:

bash

# Install ecr-credential-helper on nodes (handles token refresh automatically)
helm repo add estensio https://estensio.github.io/charts
helm install ecr-creds estensio/ecr-credentials-helper -n kube-system

Lesson: ECR tokens expire in 12 hours — shorter than a workday for some CI configurations. Always re-authenticate as the first step in any pipeline that touches ECR. Don't cache ECR credentials between pipeline runs.