unauthorized: authentication required (AWS ECR docker pull and push)

TL;DR: ECR tokens expire every 12 hours; refresh the login with aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.us-east-1.amazonaws.com. Then retry the pull. There is no static ECR password; every 'unauthorized' from ECR means mint a fresh token.

The error

unauthorized: authentication required (AWS ECR docker pull and push)

Fix it

1. Mint a fresh token and log in (replace region/account):

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.us-east-1.amazonaws.com Expected: Login Succeeded.

1. Retry:

docker pull ACCOUNT.dkr.ecr.us-east-1.amazonaws.com/myrepo:tag Expected: succeeds.

When this applies

• Any ECR pull/push failing with unauthorized
• CI jobs running longer than 12 hours

When this does NOT apply

• Docker Hub unauthorized (static credentials, separate skill)
• IAM permission errors (those surface as denied with a policy message)

Versions

All Docker versions; AWS CLI v1/v2.

Why it happens

ECR issues 12-hour authorization tokens, not passwords. The daemon caches the token in ~/.docker/config.json; once it expires, every registry call 401s until you log in again.

Edge cases

• In CI, run the get-login-password step at the START of every job, not once per day.
• ECR credential helper (amazon-ecr-credential-helper) automates refresh; configure "credsStore": "ecr-login" to stop thinking about it.
• Cross-account: the AWS principal needs ecr:GetAuthorizationToken plus repository permissions; missing repo perms give 'denied', not 'authentication required'.