How to configure ECS EC2 instances to authenticate to JFrog Artifactory Docker Registry

README.md

How to configure ECS EC2 instances to authenticate to JFrog Artifactory Docker Registry

The JFrog documentation is lacking on how to do this in a proper way, expecting to use the normal procedures for logging into docker and not in an automated way. This gets even worse if you try and configure your task to authenticate to a private registry - which does not seem to be possible.

The solution is to adjust your user-data, preferably storing your config and key in Secrets Manager.

Putting the config into Secret Manager:

aws secretsmanager update-secret --secret-id artifactory --region us-west-1 --secret-string '{"https://companyname-repo-virtual.jfrog.io": {"auth": "AUTHKEY_FROM_SETMEUP","email": "EMAIL_FROM_SETMEUP"}}'

Adjusting your User Data script:

# Install awslogs and the jq JSON parser
yum install -y awslogs jq aws-cli

# ECS config
echo ECS_CLUSTER='${ECS_CLUSTER_NAME}' >> /etc/ecs/ecs.config
echo ECS_ENGINE_AUTH_TYPE=dockercfg
echo ECS_ENGINE_AUTH_DATA=`aws secretsmanager get-secret-value --secret-id artifactory --query SecretString --output text --region us-west-1` >> /etc/ecs/ecs.config

Which would evaluate to:

# cat /etc/ecs/ecs.config
ECS_CLUSTER=clustername
ECS_ENGINE_AUTH_TYPE=dockercfg
ECS_ENGINE_AUTH_DATA={"https://companyname-repo-virtual.jfrog.io": {"auth": "AUTHKEY_FROM_SETMEUP","email": "EMAIL_FROM_SETMEUP"}}

Sources

• https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth-container-instances.html#docker-auth-formats
• https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-agent-config.html

@gdelgado strange. I can't think of any reason why that would not work - we have had multiple runs with Artifcatory credentials though, it's not at all clear which one to use at any given point and how they should be "encoded" or encoded at all. The credentials used here come straight from the "SETMEUP" guide on a repository in Artifactory. Hope this helps!

@hussfelt Just wanted to update this thread that the steps above do indeed work. The issue I was having was that after implementing the steps I was trying to execute a docker pull manually but as the env vars are configured via ECS it would try to use my local docker config instead of the ECS configured one which is done via the ECS Agent. Thanks for all the help on this..

@gdelgado thanks for following up for others reaching this thread!