Keep getting Denied: Authorization Token has expired error

I just run the get-login command
execute the output (which returns login succeeded)
then try to push a docker image
then I get the message:
denied: Your Authorization Token has expired. Please run 'aws ecr get-login' to fetch a new one.

I don't know whats going wrong, I'm pushing to the right repo, the time on my mac is correct.
This was working before, but since I reinstalled my mac and upgraded to macOS Sierra it's not working anymore, probably related to that.

My --version output:
aws-cli/1.11.34 Python/2.7.10 Darwin/16.3.0 botocore/1.4.91

$ aws ecr get-login --region eu-west-1 --profile ss
docker login -u AWS -p AQECAHh....b6Wk -e none https://1234567890.dkr.ecr.eu-west-1.amazonaws.com
$ docker login -u AWS -p AQECAHh....b6Wk -e none https://1234567890.dkr.ecr.eu-west-1.amazonaws.com
Flag --email has been deprecated, will be removed in 1.13.
Login Succeeded
$ docker push 1234567890.dkr.ecr.eu-west-1.amazonaws.com/service-web:latest
The push refers to a repository [1234567890.dkr.ecr.eu-west-1.amazonaws.com/service-web]
c1f87971dfa9: Preparing 
2eb644aea3de: Preparing 
9c8843ffe48e: Preparing 
39bb58d049d4: Preparing 
f053bc969599: Preparing 
7169084246b8: Waiting 
bb134a1936fd: Waiting 
184e76848a1c: Waiting 
75c8fcf65748: Waiting 
eb9b9ee1ea58: Waiting 
f4bf35723edd: Waiting 
ddffe1a64b3c: Waiting 
fd1a1154db16: Waiting 
b542e946067a: Waiting 
d49ed2a5e1ed: Waiting 
bb39b980367a: Waiting 
25b8358d062f: Waiting 
997eee521fc7: Waiting 
50b5447183a8: Waiting 
4339b5cb0e1d: Waiting 
3dbd4a53b21b: Waiting 
2bec16216500: Waiting 
b9fd8e264df6: Waiting 
b6ca02dfe5e6: Waiting 
denied: Your Authorization Token has expired. Please run 'aws ecr get-login' to fetch a new one.

Presumably this is the same as this StackOverflow question. Can you confirm whether the answer there worked or not?

Closing due to inactivity. Please reopen if you have anymore questions or the suggestion did not work.

For people with the same issue, check my stackoverflow question/answer:
http://stackoverflow.com/a/41387519/1362815

FYI, this is happening to me. Same symptoms. It worked fine for months but now I get the same error message.

Docker version 17.03.1-ce, build c6d412e
awscli (1.11.75)

Im getting same issue.. worked fine for months..

Docker version 17.03.1-ce, build c6d412e
aws-cli/1.11.111 Python/2.7.10 Darwin/16.6.0 botocore/1.5.74

Same here,
Docker version 17.09.0-ce, build afdb6d4
aws-cli/1.11.167 Python/2.7.9 Windows/8 botocore/1.7.25

probably worthy of noting, i'm actually using win10, but aws cli doesn't seem to identify that correctly.

... turns out, profile switch is required, despite [default] and [user1] having identical configurations. Also specifying --profile default fails. Looks like you must use a named profile that isn't default, for get-login to give something that actually works, instead of just reporting that it worked.

Upgraded docker yesterday, hosed today.

Docker version 17.09.0-ce, build afdb6d4
macOS 10.13 High Sierra
awscli (1.11.169)

$(aws ecr get-login --no-include-email)
Error saving credentials: error storing credentials - err: exit status 1, out: The user name or passphrase you entered is not correct.

Creating a different profile than "default" and trying to use that results in the same error.

aws ecr get-login --no-include-email --region=us-east-1 --profile=aws
...
Error saving credentials: error storing credentials - err: exit status 1, out: The user name or passphrase you entered is not correct.

Ultimately, deleting the osxkeychain entries, reinstalling docker and aws-cli and restarting the box resolved my authentication issue.

For me the issue was solved after adding --no-include-email in the aws ecr get-login command.
Like this:
eval $( aws ecr get-login --no-include-email --region eu-west-1 )

In my case the issue was multiple credentials in ~/.aws/credentails so I used --profile

aws ecr get-login --no-include-email --region us-east-2 --profile xxxx
This worked for me.

docker login stores its auth credentials in ~/.docker/config.json. The Your Authorization Token has expired error means those credentials are stale.

Try removing ~/.docker/config.json. docker push should now generate a no basic auth credentials error.

aws ecr get-login --no-include-email will generate a docker login command. Check the login command generated is for the same registry used in the docker push command.

In my case the issue was multiple credentials in ~/.aws/credentails so I used --profile

aws ecr get-login --no-include-email --region us-east-2 --profile xxxx
This worked for me.

I truly have multiple accounts and this helped me! Thanks man!

Had the same problem.
Just copy output that you have after aws ecr get-login --no-include-email and remove 'https://'. Works for me.

docker login -u AWS -p {token} 123456789.dkr.ecr.eu-west-2.amazonaws.com

Removal of ~/.docker/config.json is what did it for me. See https://stackoverflow.com/a/45938500/1664453

Here's what worked for me:

rm ~/.docker/config.json - Removes docker config JSON
aws ecr get-login - Exclude the --no-include-email
Copy and paste the output onto your terminal window
Manually delete the -e none part.
Run docker push command

Why not just ask people to run $(aws ecr get-login --no-include-email)?

@joseph-zhong

@joseph-zhong that certainly doesn't works for aws-cli/2.0.0 Python/3.8.1 Darwin/19.4.0 botocore/2.0.0dev4

What worked for was to do re-login.
If you are on aws-cli/2.0.0 then following might work for you as well.
aws ecr get-login-password |docker login --username AWS --password-stdin $IMAGE_PATH

aws ecr get-login-password \
    --region <region> \
| docker login \
    --username AWS \
    --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login-password.html

Just a casual note: "ecr get-login" disappeared in version 2 of the AWS CLI. This is actually kind of a good thing, it's a little bit of a security risk.

You now have to use "ecr get-login-password"

https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login-password.html
The password is valid for 12 hours.

I too verified the returned token had a 12 hour lifespan, so the token is valid.

From what I can tell, this is a Docker issue/behavior.

I'm in the process of switching over to python instead of the CLI. In order to get passed this "expired" issue, it was necessary to hide/delete the ~/.docker/config.json file.

Here's what I found:

Given the following CLI operation:

aws ecr get-login-password --region %REGION% --profile %PROFILE% | docker login --username AWS --password-stdin %ACCOUNT%.dkr.ecr.%REGION%.amazonaws.com

the operation is generating the config.json file which describes a credentials store for the given endpoint; i.e., wincred

{
	"auths": {
		"0123456789.dkr.ecr.us-east-1.amazonaws.com": {}
	},
	"HttpHeaders": {
		"User-Agent": "Docker-Client/19.03.12 (windows)"
	},
	"credsStore": "wincred"
}

The python operation dkr.login(...) was effectively picking up the wincred from the config.json instead of the STS creds just acquired from AWS. Apparently, this is a feature and not a bug*.

def aws(service):
    global boto3, profile, region
    session = boto3.session.Session(region_name=region, profile_name=profile)
    return session.client(service)

def authenticate():
    global dkr
    ecr = aws("ecr")
    token = ecr.get_authorization_token()
    authData = token["authorizationData"][0]
    authToken = authData["authorizationToken"]
    decode = base64.b64decode(authToken).decode()
    _, password = decode.split(":")
    registry = authData["proxyEndpoint"].replace("https://", "")
    dkr.login(username="AWS", password=password, registry=registry)
    print(authData["expiresAt"])
    print("Docker logged in...")

Despite the older creds reference by config.json, the dkr.login(...) operation didn't fail. Failure only occurred at the point of dkr.images.push(...).

* A feature.... Reviewing the docker/docker-py repo @ github, it seems the login(...) operation is utilizing the existing config.json file if it already exists. Here's one of many locations where the existing config.json is being referenced/utilitized: source

Setting the reauth login(...) option forces the real login operation to execute -- subsequently the config file was regenerated by something.

The login operation also permits an alternate config file which is probably the way to go for CI.

Here's another starting point to review what's going on: load_config

Revert cached parallel builds (aws#2351)

feat: Cached and Parallel build implementation (aws#2351) (aws#2357)

My issue: If you run aws ecr get-login-password without sudo and docker push with sudo, you will get this error. Run both commands with sudo.

You are correct sujeethkanuganti

My issue: If you run aws ecr get-login-password without sudo and docker push with sudo, you will get this error. Run both commands with sudo.

Fixed after removing sudo

none of above solutions work for me.

In my case, I had to docker logout <ecr repo URL> once, and re-login to make it work.

Navigation Menu

Repository navigation

Keep getting `Denied: Authorization Token has expired` error #2351

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Keep getting Denied: Authorization Token has expired error #2351

Description

Activity

JordonPhillips commented on Dec 29, 2016

kyleknap commented on Jan 18, 2017

lu3do commented on Jan 19, 2017

LusciousPear commented on Apr 10, 2017

philpalmieri commented on Jun 23, 2017

ericblade commented on Oct 9, 2017

Spechal commented on Oct 12, 2017

guppie70 commented on Nov 19, 2017

chetanhomify commented on Mar 4, 2018

tekumara commented on Aug 25, 2018

axozoid commented on Nov 13, 2018

2 remaining items

michaeljaszczuk commented on May 9, 2019

stieg commented on May 16, 2019

rgil90 commented on Mar 29, 2020

joseph-zhong commented on Apr 3, 2020

subhadeepkaran commented on May 15, 2020

subhadeepkaran commented on May 15, 2020

stefaniaive commented on May 15, 2020

rklahnaisera commented on May 31, 2020

webxiaohua commented on Jun 18, 2020

tvkit commented on Sep 27, 2020

sujeethkanuganti commented on Mar 30, 2022

MuralidaranCT commented on Jun 12, 2022

tranvansang commented on Oct 10, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Keep getting `Denied: Authorization Token has expired` error #2351