title: Docker push to AWS ECR fails on Windows: no basic auth credentials
body: <p>I am using docker on windows (Docker for Windows, not Docker Toolbox) and aws cli in cygwin ("git bash") shell. I'm trying to push a docker image into AWS ECR - the private ECS repository.</p>
  
  <p>Whatever I do - when I'm running <code>docker push</code> I repeatedly get:</p>
  
  <pre><code>no basic auth credentials
  </code></pre>
  
  <h2>Method 1</h2>
  
  <p>I have been following instructions and running the standard commands:</p>
  
  <pre><code>$ $(aws --profile myprofile ecr get-login --region us-east-1)
  Login Succeeded
  $ docker tag myrepo:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myrepo:latest
  $ docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myrepo:latest
  The push refers to a repository [232097583865.dkr.ecr.us-east-1.amazonaws.com/potion]
  688f61a6956d: Preparing
  11908ead416e: Preparing
  no basic auth credentials
  </code></pre>
  
  <p>No success.</p>
  
  <p>Trying to pull reveals that indeed, I don't have access:</p>
  
  <pre><code>$ docker pull 123456789.dkr.ecr.us-east-1.amazonaws.com/myrepo
  Using default tag: latest
  Pulling repository 123456789.dkr.ecr.us-east-1.amazonaws.com/myrepo
  unauthorized: authentication required
  </code></pre>
  
  <p>However docker <em>does</em> think that I'm logged in:</p>
  
  <pre><code>$ docker logout https://123456789.dkr.ecr.us-east-1.amazonaws.com
  Remove login credentials for https://123456789.dkr.ecr.us-east-1.amazonaws.com
  
  # let's run again - should not be logged in now
  $ docker logout https://123456789.dkr.ecr.us-east-1.amazonaws.com
  Not logged in to https://123456789.dkr.ecr.us-east-1.amazonaws.com
  </code></pre>
  
  <p>Hmm.</p>
  
  <h2>Method 2</h2>
  
  <p>Internet suggests dissecting the command and using an older procedure to log on.</p>
  
  <p>Basically boils down to something like this:</p>
  
  <pre><code>docker login -u AWS -p $(aws --profile myprofile ecr get-authorization-token --region us-east-1 --output text --query authorizationData[].authorizationToken | python -c 'import base64, sys; print base64.b64decode(sys.stdin.read())' | cut -d: -f2) https://123456789.dkr.ecr.us-east-1.amazonaws.com
  </code></pre>
  
  <p>This also seems to succeed, but <code>docker push</code> or <code>pull</code> result in the same failure.</p>
  
  <h2>Other Dead Ends</h2>
  
  <p>Windows and cygwin is weird. So, let's put the <code>docker login</code> command in a shell script file, and run it, or source it. No success.</p>
  
  <p>Generating additional AMI profiles with explicit access tokens and new sets of credentials. No success.</p>
  
  <p>Exporting the AWS credentials as environment variables and repeating the process. No success.</p>
  
  <p>Using the awesome <a href="https://github.com/EvidentSecurity/MFAonCLI/blob/master/aws-temp-token.sh" rel="noreferrer">aws-temp-token.sh</a> script that takes an MFA code and generates session credentials as environment variables. No success (though the tool is a life saver at other times, so use it).</p>
  
  <h2>Spoiler Alert</h2>
  
  <p>I did eventually manage to solve this problem. It was so frustrating though and I found no online mention of the solution, so writing an answer should hopefully relieve some of the mental pain.</p>