0

I'm having a strange problem pulling an image from ECR into my EC2 instances. This command:

aws ecr get-login-password --region us-east-2

times out. This has been working for months (I'm familiar with this link that describes how to trouble-shoot logging into ECR, and that's not the problem).

Here's what weird:

  1. get-login-password works successfully from my local machine when I'm pushing to or pulling a container from ECR, but fails when I want to try to pull that image from ECR to an EC2 instance (same AWS credentials are used).
  2. But if I use a different region (us-east-1 or us-west-1), a password is returned.
  • I'm using version 2.7.7 of the aws CLI on my EC2 instance and 2.5.6 on my local machine (a mac).
  • I have admin privileges on AWS.
  • aws sts-caller-identity returns successfully, so my credentials are valid.
  • As far as I know, nothing has changed in w/r/t the EC2 instances (I'm the admin)
  • I turned on debug - here's the relevant stack trace:

2022-12-15 19:53:23,884 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (3): api.ecr.us-east-2.amazonaws.com:443
2022-12-15 19:56:24,064 - MainThread - botocore.endpoint - DEBUG - Exception received when sending HTTP request
Traceback (most recent call last):
File "urllib3/connection.py", line 174, in _new_conn
File "urllib3/util/connection.py", line 95, in create_connection
File "urllib3/util/connection.py", line 85, in create_connection
socket.timeout: timed out

My assumption would be that there's an issue with the ECR service in us-east-2 except that I can login and push or pull containers from my local machine but not from my EC2 instances.

chipzx
  • 1
  • 1
  • It sounds like the EC2 instance isn't able to talk to the `us-east-2` ECR endpoint. Your instance doesn't have internet connectivity, right? – Paolo Dec 15 '22 at 20:51
  • @paolo That seems to be it, but I don't understand why - it can talk to the `us-east-1` and `us-west-1` ECR endpoints. I don't restrict any outbound traffic. – chipzx Dec 15 '22 at 21:15
  • You must have VPC endpoint deployed in those regions, but not in `us-east-2` – Paolo Dec 15 '22 at 21:19

0 Answers0