Search code examples
amazon-web-servicescontainersamazon-ecsghcr

Is it possible to authenticate https://ghcr.io for ECS task

I have ECS service, which needs to pull image from https://ghcr.io via PAT token. Is this possible at all? Is there any way to authenticate to github container registry?

Thank you for the assistance!

BR,

Martin

Solution

  • Yes it's possible. The article linked in the comment to the question shows how it is done, as does the aws documentation.

    The article covers everything you need to do, at a high level:

    • Create a PAT token for a Github user that has at least 'read' access to the required repo.
    • Create an AWS SecretsManager secret containing credentials, in format { "username":"<gh-username>", "password":"<PAT-token>" }
    • Grant the TaskExecutionRole (not TaskRole) access to this secret - it's the execution role that requires access to pull the image.
    • Set the repository_credentials property of the container definition to the arn of the secret containing credentials