I am having issues deploying my docker images to aws ecr as part of a terraform deployment and I am trying to think through the best long term strategy.

At the moment I have a terraform remote backend in s3 and dynamodb on let's call it my master account. I then have dev/test etc environments in separate accounts. The terraform deployment is currently run off my local machine (mac) and uses the aws 'master' account and its credentials which in turn assumes a role in the target deployment account to create the resources as per:

```
provider "aws" { // tell terraform which SDK it needs to load
  alias  = "target"
  region = var.region
  assume_role {

  role_arn = "arn:aws:iam::${var.deployment_account}:role/${var.provider_env_deployment_role_name}"
  }
}

```

I am creating a number of ecs services with Fargate deployments. The container images are built in separate repos by GitHub Actions and saved as GitHub packages. These package names and versions are being deployed after the creation of the ecr and service (maybe that's not ideal thinking about it) and this is where the problems arise.

The process is to pull the image from GitHub Packages, retag it and upload to the ecr using multiple executions of a null\_resource local-exec. Works fine stand alone but has problems as part of the terraform process. I think the reason is that the other resources use the above provider to get permissions but as null\_resource does not accept a provider it cannot get the permissions this way. So I have been passing the aws creds values into the shell. Not convinced this is really secure but that's currently moot as it ain't working either. I get this error:

```
Error saving credentials: error storing credentials - err: exit status 1, out: `error storing credentials - err: exit status 1, out: `The specified item already exists in the keychain.``

```

Part of me thinks this is the wrong approach and that as I migrate to deploying via a Github action I can separate the infrastructure deployment via terraform from what is really the application deployment and just use GitHub secrets to reset the credentials values then run the script.

Alternatively, maybe the keychain thing just goes away and my process will work fine? Secure ??

That's fine for this scenario but it isn't really a generic approach for all my use cases.

I am shortly going to start deploying multiple aws lambda functions with docker containers. Haven't done it before but it looks like the process is going to be: create ecr, deploy container, deploy lambda function. This really implies that the container deployment should integral to the terraform deployment which loops back to my issue with the local-exec??

I found [Actions to deploy to ECR](https://stackoverflow.com/questions/61242936/github-action-deploy-docker-to-aws-ecs-ecr) which would imply splitting the deployments into multiple files but that seems inelegant and potentially brittle.

Maybe there is a simple solution, but given where I am trying to go with this, what is my best approach?