Aws-cli: aws ecr get-login error: argument operation: Invalid choice

[arthurliebhardt]

Hello,

$(aws ecr get-login --no-include-email --region eu-central-1)

gives me following:

usage: aws [options] [ ...] [parameters]
To see help text, you can run:

aws help
aws help
aws help
aws: error: argument operation: Invalid choice, valid choices are:

aws-cli/2.0.0 Python/3.8.1 Darwin/19.3.0 botocore/2.0.0dev4 are my versions.

[arthurliebhardt]

Ok the documentation states: "This command is deprecated. Use get-login-password instead."

[rpnguyen]

The AWS CLI version 2 migration guide has information about the ECR changes introduced in V2. ecr get-login-password is now the recommended method for logging in to ECR using the AWS CLI. For more information, see Registry Authentication.

Edit: The ECR Credential Helper (as mentioned by mayordwells) is easier and more convenient than using the CLI

[mayordwells]

If you find yourself here, save yourself some time/headache by skipping the login step.

Using ECR credentials helper, referenced in this documentation - https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html
With that helper, There is no need to use docker login or docker logout.

Find the installation instruction here - https://github.com/awslabs/amazon-ecr-credential-helper

[omerh]

You can use this: https://github.com/omerh/aws-docker-login

[yaireclipse]

If you still want to use cli (maybe for automation), this is the full command, according to the official docs, that also worked for me:

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

where:

• <region> - is the region name to which you want to push the image, e.g. us-east-1
• <aws_account_id> - how to find your aws account ID

Note that --username should remain set to AWS.

[alam0rt]

I alias this to ecr-login

 aws ecr get-login-password | docker login --username AWS --password-stdin "$(aws sts get-caller-identity --query Account --output text).dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"

[raxit65535]

I am getting error with aws ecr get-login-password | docker login --username AWS --password-stdin <>.dkr.ecr.<>.amazonaws.com
Error: Cannot perform an interactive login from a non TTY device
What is the reason for that?

[danielmaartens-sovtech]

@raxit65535 I am also getting this error output with aws ecr get-login-password | docker login --username AWS --password-stdin <>.dkr.ecr.<>.amazonaws.com

But as you can see from the commands that follow if I use get-login argument (which is deprecated) then no error is thrown for the command before the pipe and it tries the command after the pipe.

This tells me that maybe the cli we're using is out of date ? I don't know if that is even how it works. But maybe that is the issue.

I will upgrade my cli and then try again and keep you posted.

[danielmaartens-sovtech]

@raxit65535 Yup as I suspected.

One of the breaking changes is:

[yaireclipse]

I am getting error with aws ecr get-login-password | docker login --username AWS --password-stdin <>.dkr.ecr.<>.amazonaws.com
Error: Cannot perform an interactive login from a non TTY device
What is the reason for that?

@raxit65535 AFAIK this error (in this context) might occur due to not being logged in to AWS through the AWS CLI. Try running aws configure.

[danielmaartens-sovtech]

@yaireclipse @raxit65535

Confirmed. if you're still using aws cli v1 then upgrading aws cli to version 2 fixes that error (at least if yours is in the same context as the one I've been getting). Hopefully it solves your issue too @raxit65535 .

[yaireclipse]

@danielmaartens-sovtech I'm not sure if it's you or me that miss something, but it seems that @raxit65535 already uses the new CLI version (get-login-password) and yet get that error. Hence my suggestion for making sure he's logged in 😃 .

[danielmaartens-sovtech]

@raxit65535 Which cli version are you using ?

[someorganicmatter]

I am getting error with aws ecr get-login-password | docker login --username AWS --password-stdin <>.dkr.ecr.<>.amazonaws.com
Error: Cannot perform an interactive login from a non TTY device
What is the reason for that?

@raxit65535 Are you executing this command from an EC2 instance by any chance?

[danielmaartens]

@danielmaartens-sovtech I'm not sure if it's you or me that miss something, but it seems that @raxit65535 already uses the new CLI version (get-login-password) and yet get that error. Hence my suggestion for making sure he's logged in 😃 .

@yaireclipse He did not specify which version he is using.

@raxit65535 can you please confirm that get-login-password appears in the list of available commands when you execute aws ecr help ? If it does not, but instead has get-password then you are using CLI v1 and need to upgrade to v2 to access that command.

[someorganicmatter]

@danielmaartens-sovtech I am also facing the same issue. I have the setup on an EC2 instance (if that makes any difference). I just checked executing aws ecr help. Did you mean get-login instead of get-password?

The list of available commands shows get-login instead of get-password or get-login-password for me.

EDIT: Before writing this comment I could swear I had AWS CLI version2 installed on a fresh EC2 instance. Somehow, because I restarted the instance it CLI went back to version1. I noticed this and created a new instance (because same steps to install version2 were no longer working) with AWS CLI version2.

[ec2-user@ip-10-0-23-89 fetch-and-run]$ aws --version
aws-cli/2.0.19 Python/3.7.3 Linux/4.14.181-140.257.amzn2.x86_64 botocore/2.0.0dev23

Now I am able to see get-login-password.
Still when I copy paste the exact command from ECR console, I get the same error.

I thought maybe my EC2 instance does not have valid credentials (or being logged in as @ yaireclipse says), so tried this:
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-metadata.html
(though I think this is optional, since EC2 should use attached instance profile role's credentials by default).
Also would like to mention that this role has ECR access (AmazonEC2ContainerRegistryPowerUser - AWS managed policy).