{"record":{"id":"ab2c4d1c333c157b","repo":"serverless/serverless","slug":"aws-ecr-login-failed","errorCode":"AWS_ECR_LOGIN_FAILED","errorMessage":"Failed to get authorization data from ECR","messagePattern":"Failed to get authorization data from ECR","errorType":"exception","errorClass":"ServerlessError","httpStatus":null,"severity":"error","filePath":"packages/engine/src/lib/aws/ecr.js","lineNumber":95,"sourceCode":"      throw new ServerlessError(error.message, 'AWS_ECR_REPOSITORY_NOT_FOUND')\n    }\n  }\n\n  /**\n   * Login to AWS ECR repository using Docker\n   * @param {Object} params - Login parameters\n   * @param {string} params.ecrRepository - The ECR repository URI to login to\n   * @returns {Promise<void>}\n   */\n  async loginToEcrRepository({ ecrRepository }) {\n    const authResponse = await this.client.send(\n      new GetAuthorizationTokenCommand({}),\n    )\n    if (\n      !authResponse.authorizationData ||\n      !authResponse.authorizationData[0].authorizationToken\n    ) {\n      throw new ServerlessError(\n        'Failed to get authorization data from ECR',\n        'AWS_ECR_LOGIN_FAILED',\n      )\n    }\n\n    const authToken = authResponse.authorizationData[0].authorizationToken\n    const [username, password] = Buffer.from(authToken, 'base64')\n      .toString()\n      .split(':')\n\n    // Docker login to ECR\n    const loginCommand = `echo ${password} | docker login --username ${username} --password-stdin ${ecrRepository}`\n    await execAsync(loginCommand)\n\n    logger.debug('Successfully logged into AWS ECR repository')\n  }\n\n  /**","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/serverless/serverless/blob/b9d7ea51c8cce57cff1207964b9b71123673081f/packages/engine/src/lib/aws/ecr.js#L77-L113","documentation":"Thrown by ECR.loginToEcrRepository (ecr.js:95) when GetAuthorizationTokenCommand resolves successfully but authorizationData or authorizationData[0].authorizationToken is absent. The AWS contract guarantees a populated authorizationData array for valid accounts, so reaching this throw usually means ECR is not enabled or the response shape is unexpected. Note: the subsequent docker login execAsync (ecr.js:108) is NOT in this error path — a docker failure surfaces as a raw child_process error instead.","triggerScenarios":"GetAuthorizationToken returns with authorizationData === undefined or an empty array; authorizationData[0].authorizationToken missing. Happens when the account has no ECR registry in the region, the caller lacks ecr:GetAuthorizationToken (usually throws instead), or an SDK/proxy mangled the response.","commonSituations":"Brand-new AWS account where ECR has never been initialised in the region; a region that does not offer ECR; an outdated @aws-sdk/client-ecr returning a different shape; corporate MITM proxy stripping response fields. Security note: the password is interpolated into a shell command string (line 107) — generally safe for AWS tokens but visible in process listings.","solutions":["Confirm ecr:GetAuthorizationToken is allowed and run aws ecr get-login-password --region <region> manually to verify the registry responds.","Ensure the AWS account has been initialised for ECR in the target region (pushing any image once enables it).","Align @aws-sdk/client-ecr version across the engine.","Verify docker is installed and reachable, since the later execAsync is a separate failure surface."],"exampleFix":"// before\nif (!authResponse.authorizationData || !authResponse.authorizationData[0].authorizationToken) {\n  throw new ServerlessError('Failed to get authorization data from ECR', 'AWS_ECR_LOGIN_FAILED')\n}\n\n// after — surface why it was empty\nconst data = authResponse.authorizationData?.[0]\nif (!data?.authorizationToken) {\n  throw new ServerlessError(\n    `ECR returned no authorization token (region=${region}, data=${JSON.stringify(authResponse).slice(0, 200)})`,\n    'AWS_ECR_LOGIN_FAILED',\n  )\n}","handlingStrategy":"validation","validationCode":"// Ensure the deploy role can fetch an auth token before calling loginToEcrRepository\n// Required permission: ecr:GetAuthorizationToken on '*'\n// And confirm docker is installed: which docker","typeGuard":"function hasAuthorizationToken(res) {\n  return Boolean(\n    res && Array.isArray(res.authorizationData) &&\n    res.authorizationData[0] && typeof res.authorizationData[0].authorizationToken === 'string'\n  )\n}","tryCatchPattern":"try {\n  await ecr.loginToEcrRepository({ ecrRepository })\n} catch (e) {\n  if (e.code === 'AWS_ECR_LOGIN_FAILED') {\n    throw new Error(`ECR auth token unavailable in region ${region}; ensure ECR is enabled and ecr:GetAuthorizationToken is allowed`)\n  }\n  throw e\n}","preventionTips":["Grant ecr:GetAuthorizationToken to the deploy role.","Verify docker is installed and the daemon is running before the push flow.","Confirm ECR is enabled in the region (push any image once to initialise)."],"tags":["ecr","docker","aws","registry"],"backgroundTag":null,"analyzedSha":"b9d7ea51c8cce57cff1207964b9b71123673081f","analyzedAt":"2026-08-13T04:14:40.386Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}