Unable to pull an image from AWS ECR with the following error from Kubernetes using CRI-O as Container Runtime Interface.

Failed to pull image "<aws_account_id>.dkr.ecr.<region-name>.amazonaws.com/<image>": reading manifest <version> in <aws_account_id>.dkr.ecr.<region-name>.amazonaws.com/<image>: authentication required

1 Answer 1


You'll want to install Skopeo and run the following command. Make sure to replace the region with the region your ECR image is stored in.

skopeo login -u AWS -p $(/usr/local/bin/aws ecr get-login-password --region <AWS Region>) $(/usr/local/bin/aws sts get-caller-identity --query Account --output text).dkr.ecr.<AWS Region>.amazonaws.com

I recommend turning this into a CRON Job and having it run every 11 hours since the tokens expire after 12 hours.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .