Skip to content

Instantly share code, notes, and snippets.

@hussfelt
Last active July 23, 2020 18:13
Show Gist options
  • Save hussfelt/2cd0216a68d42b411fe19f7a068a7023 to your computer and use it in GitHub Desktop.
Save hussfelt/2cd0216a68d42b411fe19f7a068a7023 to your computer and use it in GitHub Desktop.
How to configure ECS EC2 instances to authenticate to JFrog Artifactory Docker Registry

How to configure ECS EC2 instances to authenticate to JFrog Artifactory Docker Registry

The JFrog documentation is lacking on how to do this in a proper way, expecting to use the normal procedures for logging into docker and not in an automated way. This gets even worse if you try and configure your task to authenticate to a private registry - which does not seem to be possible.

The solution is to adjust your user-data, preferably storing your config and key in Secrets Manager.

Putting the config into Secret Manager:

aws secretsmanager update-secret --secret-id artifactory --region us-west-1 --secret-string '{"https://companyname-repo-virtual.jfrog.io": {"auth": "AUTHKEY_FROM_SETMEUP","email": "EMAIL_FROM_SETMEUP"}}'

Adjusting your User Data script:

# Install awslogs and the jq JSON parser
yum install -y awslogs jq aws-cli

# ECS config
echo ECS_CLUSTER='${ECS_CLUSTER_NAME}' >> /etc/ecs/ecs.config
echo ECS_ENGINE_AUTH_TYPE=dockercfg
echo ECS_ENGINE_AUTH_DATA=`aws secretsmanager get-secret-value --secret-id artifactory --query SecretString --output text --region us-west-1` >> /etc/ecs/ecs.config

Which would evaluate to:

# cat /etc/ecs/ecs.config
ECS_CLUSTER=clustername
ECS_ENGINE_AUTH_TYPE=dockercfg
ECS_ENGINE_AUTH_DATA={"https://companyname-repo-virtual.jfrog.io": {"auth": "AUTHKEY_FROM_SETMEUP","email": "EMAIL_FROM_SETMEUP"}}

Sources

@gdelgado
Copy link

@hussfelt Just wanted to update this thread that the steps above do indeed work. The issue I was having was that after implementing the steps I was trying to execute a docker pull manually but as the env vars are configured via ECS it would try to use my local docker config instead of the ECS configured one which is done via the ECS Agent. Thanks for all the help on this..

@hussfelt
Copy link
Author

@gdelgado thanks for following up for others reaching this thread!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment