Skip to content

Document MFA workaround #310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Document MFA workaround #310

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
baca8b3
Document MFA workaround
omus Feb 16, 2022
598bcf6
Merge branch 'main' into cv/mfa-workaround
omus Jun 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,10 @@ variable to `false`. The supported options include:
bug](https://github.com/kubernetes-sigs/external-dns/pull/1185) and may need to employ a workaround adjusting the
Kubernetes `securityContext`.*)

Configuration options which are known to be *not* supported include:

* Roles using `mfa_serial` (see the [MFA](#mfa) section for a workaround)

The Amazon ECR Docker Credential Helper uses the same credentials as the AWS
CLI and the AWS SDKs. For more information about configuring AWS credentials,
see
Expand Down Expand Up @@ -265,6 +269,16 @@ For example:

There is no need to use `docker login` or `docker logout`.

### MFA

The Amazon ECR Docker Credential helper does not currently work with AWS profiles requiring MFA as it does not prompt for a token.
If you use a profile which requires an MFA token you can work around this by using the AWS STS service to [request temporary security credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html).
One option for generating temporary credentials is to use the [`aws-vault`](https://github.com/99designs/aws-vault) tool:

```sh
aws-vault exec myprofile -- docker pull 123456789012.dkr.ecr.us-west-2.amazonaws.com/my-repository:my-tag
```

## Troubleshooting

If you have previously authenticated with an ECR repository by using the `docker login` command manually
Expand Down