1. Resources
  2. /
  3. Plugins
  4. /
  5. ecr-buildkite-plugin

ECR Buildkite Plugin Build status

A Buildkite plugin to login to an ECR repository before running a build step.

This will use standard AWS credentials available in the environment, or as an instance role or task role as available. These must be granted appropriate permissions for login to succeed and for push and pull to operate.

Example

This will login docker to ECR prior to running your script.

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.9.0:
          login: true

If you want to log in to ECR on another account:

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.9.0:
          login: true
          account_ids: "0015615400570"
          region: "ap-southeast-2"

If you need to assume a role to perform that login:

steps:
  - command: ./run_build.sh
    plugins:
      - ecr#v2.9.0:
          login: true
          account-ids: "0015615400570"
          region: "ap-southeast-2"
          assume_role:
            role_arn: "arn:aws:iam::0015615400570:role/demo"

Options

login

Whether to login to your account’s ECR.

account-ids (optional)

Either a string, or a list of strings with AWS account IDs that correspond to the Amazon ECR registries that you want to log in to. Make sure to quote these if they start with a 0.

You can use the literal public.ecr.aws as a value to authenticate against AWS ECR public registries.

:warning: If you are using ECR Credential Helper in your docker configuration it is possible you have to add https:// to your account IDs to prevent an error (see the corresponding bug report for more information).

no-include-email (optional)

Obsolete if using AWS CLI version 1.17.10 or newer.

Add --no-include-email to ecr get-login. Required for docker 17.06+, but needs aws-cli 1.11.91+.

region (optional)

Set a specific region for ECR, defaults to AWS_DEFAULT_REGION on the agent, or us-east-1 if none specified.

retries (optional)

Retries login after a delay N times. Defaults to 0.

assume-role (optional)

Updates AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables.

Assume an AWS IAM role before ECR login. Supports role-arn and duration-seconds (optional) per the associated AWS CLI command.

profile (optional)

Requires AWS CLI version 1.17.10 or greater.

Use a different AWS profile from the default during ECR login.

License

MIT (see LICENSE)

The plugins listed on this webpage are provided for informational purposes only. They have not undergone any formal security review or assessment. While we strive to provide useful resources, we cannot guarantee the safety, reliability, or integrity of these plugins. Users are strongly advised to conduct their own security evaluations before downloading, installing, or using any plugin. By using these plugins, you acknowledge and accept any risks associated with their use. We disclaim any liability for any harm or damages arising from the use of the plugins listed.

Start turning complexity into an advantage

Create an account to get started with a 30-day free trial. No credit card required.

Buildkite Pipelines

Platform

  1. Pipelines
  2. Pipeline templates
  3. Public pipelines
  4. Test Engine
  5. Package Registries
  6. Mobile Delivery Cloud
  7. Pricing

Hosting options

  1. Self-hosted agents
  2. Mac hosted agents
  3. Linux hosted agents

Resources

  1. Docs
  2. Blog
  3. Changelog
  4. Webinars
  5. Plugins
  6. Case studies
  7. Events
  8. Migration Services
  9. Comparisons

Company

  1. About
  2. Careers
  3. Press
  4. Brand assets
  5. Contact

Solutions

  1. Replace Jenkins
  2. Workflows for AI/ML
  3. Testing at scale
  4. Monorepo mojo
  5. Bazel orchestration

Legal

  1. Terms of Service
  2. Acceptable Use Policy
  3. Privacy Policy
  4. Subprocessors
  5. Service Level Agreement

Support

  1. System status
  2. Forum
© Buildkite Pty Ltd 2025