"CredentialsProviderError: Could not load credentials from any providers" error when attempting to connect to private AWS ECR repositories #27014

Chilinot · 2024-02-02T09:49:47Z

Chilinot
Feb 2, 2024

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.163.1

If you're self-hosting Renovate, select which platform you are using.

github.com

Was this something which used to work for you, and then stopped?

I have not seen this working

Describe the problem

When trying to setup authentication to our private ECR repositories we get the following error: ECR getAuthorizationToken error

These are the contents of our github action workflow:

name: Renovate
on:
  workflow_dispatch: # Allow manually triggering this workflow
  schedule:
    # The "*" (#42, asterisk) character has special semantics in YAML, so this
    # string has to be quoted.
    - cron: '0 * * * *'

permissions: # Required for OIDC-AWS
  id-token: write
  contents: read

jobs:
  renovate:
    runs-on: self-hosted
    timeout-minutes: 30
    steps:

      - name: Get github token
        id: get_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.RENOVATEBOT_APP_ID }}
          private_key: ${{ secrets.RENOVATEBOT_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4.1.1

      - name: Configure AWS Credentials
        id: aws-creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: "arn:aws:iam::<redacted>:role/github-actions/<redacted>"
          aws-region: eu-west-1
          role-session-name: "renovatebot"
          role-duration-seconds: 1800
          role-skip-session-tagging: true
          output-credentials: true

      - name: Renovate
        uses: renovatebot/github-action@v40.0.2
        with:
          renovate-version: 37.163.1
          configurationFile: renovate-general-config.js
          token: "${{ steps.get_token.outputs.token }}"
        env:
          AWS_ACCESS_KEY_ID: "${{ steps.aws-creds.outputs.aws-access-key-id }}"
          AWS_SECRET_ACCESS_KEY: "${{ steps.aws-creds.outputs.aws-secret-access-key }}"
          AWS_SESSION_TOKEN: "${{ steps.aws-creds.outputs.aws-session-token }}"
          LOG_LEVEL: "debug"

These are the contents of the renovate-global-config.js file:

module.exports = {
    "repositories": [
        "<redacted>"
    ],
    "extends": [
        "config:recommended",
        ":dependencyDashboardApproval"
    ],
    "argocd": {
        "fileMatch": [
            "\\.yaml$",
            "\\.yml$"
        ]
    },
    "recreateWhen": "always",
    "additionalBranchPrefix": "{{{ replace '(.*?)\\/.*' '$1' packageFileDir}}}/",
    "commitMessagePrefix": "{{{ replace '(.*?)\\/.*' '$1' packageFileDir}}}/",
    "hostRules": [
        {
            "hostType":  "ecr",
            "matchHost": "<redacted>.dkr.ecr.eu-west-1.amazonaws.com",
            "username":  process.env.AWS_ACCESS_KEY_ID,
            "password":  process.env.AWS_SECRET_ACCESS_KEY,
            "token":     process.env.AWS_SESSION_TOKEN
        },
    ]
};

Relevant debug logs

Logs

Debug logs for the error:

DEBUG: Failed to look up docker package <redacted>.dkr.ecr.eu-west-1.amazonaws.com/<redacted> (repository=<redacted>, packageFile=kustomization.yml, dependency=<redacted>.dkr.ecr.eu-west-1.amazonaws.com/<redacted>)
 WARN: ECR getAuthorizationToken error (repository=<redacted>)
DEBUG: Failed to get authHeaders for getTags lookup (repository=<redacted>)

Trace logs showing the backtrace:

TRACE: err (repository=<redacted>)
       "err": {
         "tryNextLink": false,
         "name": "CredentialsProviderError",
         "$metadata": {"attempts": 1, "totalRetryDelay": 0},
         "message": "Could not load credentials from any providers",
         "stack": "CredentialsProviderError: Could not load credentials from any providers\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/@aws-sdk/credential-provider-node/dist-cjs/defaultProvider.js:13:11\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/@smithy/property-provider/dist-cjs/chain.js:11:28\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at coalesceProvider (/opt/containerbase/tools/renovate/37.163.1/node_modules/@smithy/property-provider/dist-cjs/memoize.js:14:24)\n    at SignatureV4.credentialProvider (/opt/containerbase/tools/renovate/37.163.1/node_modules/@smithy/property-provider/dist-cjs/memoize.js:33:24)\n    at SignatureV4.signRequest (/opt/containerbase/tools/renovate/37.163.1/node_modules/@smithy/signature-v4/dist-cjs/SignatureV4.js:106:29)\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/@aws-sdk/middleware-signing/dist-cjs/awsAuthMiddleware.js:16:18\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/@smithy/middleware-retry/dist-cjs/retryMiddleware.js:27:46\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/@aws-sdk/middleware-logger/dist-cjs/loggerMiddleware.js:7:26\n    at getECRAuthToken (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/docker/ecr.ts:27:18)\n    at getAuthHeaders (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/docker/common.ts:103:20)\n    at DockerDatasource.getDockerApiTags (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/docker/index.ts:633:21)\n    at DockerDatasource.getTags (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/docker/index.ts:702:16)\n    at /opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/util/cache/package/decorator.ts:119:18\n    at DockerDatasource.getReleases (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/docker/index.ts:998:36)\n    at getRegistryReleases (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/index.ts:77:15)\n    at fetchReleases (/opt/containerbase/tools/renovate/37.163.1/node_modules/renovate/lib/modules/datasource/index.ts:289:15)"
       }
WARN: ECR getAuthorizationToken error (repository=<redacted>)

Have you created a minimal reproduction repository?

Placeholder value, please select the correct response from the dropdown

Chilinot · 2024-02-02T10:01:03Z

Chilinot
Feb 2, 2024
Author

According to the source code

renovate/lib/modules/datasource/docker/ecr.ts

Line 12 in 649fb78

export async function getECRAuthToken(

this should work. I have tried this many different ways.

I have tried removing the username, password, and token settings in the renovate config so that hopefully the aws-sdk can find the creds itself and use the aws-role that the previous step authenticates against.
I have tried to sign into ECR directly using aws ecr get-login-password --region eu-west-1, catch the contents of that output, and use the token it generated to sign into ECR by setting username: "AWS", and password: process.env.ECR_TOKEN (and setting the ECR_TOKEN env value in the step using the output of the previous step of course).
I have tried setting hostType to docker. Doesnt change anything.
And lots of other ways to get it to authenticate that i cant remember from the top of my head. Have tried all of the results i can find when searching for solutions to this that other people have discussed regarding renovatebot.

After having spent days on trying to get this work in all sorts of ways i caved in and asked ChatGPT to find any problems with the getECRAuthToken above. And it said:

<updated code removed for brevity>
In this corrected version, I replaced ecr.getAuthorizationToken({}) with ecr.send(new GetAuthorizationTokenCommand({})). The send method is used to invoke commands in the AWS SDK.

I have not forked your repository to attempt to make this change yet. But am considering it since i cant find any other way to get this working. Also im not entirely sure that is the problem. As far as i understand from reading the aws-sdk docs. the getAuthorizationToken function basically does what it suggested anyway.

1 reply

super-mcgin Jul 5, 2024

I've put up a PR that should hopefully address this - #30053

helenyugithub · 2025-07-24T20:21:23Z

helenyugithub
Jul 24, 2025

I had the exact same problem and resolved it by allowlisting the AWS env variables:

env-regex: "^(?:RENOVATE_\\w+|LOG_LEVEL|GITHUB_COM_TOKEN|AWS_\\w+)$"

No host rules needed

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

"CredentialsProviderError: Could not load credentials from any providers" error when attempting to connect to private AWS ECR repositories #27014

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

"CredentialsProviderError: Could not load credentials from any providers" error when attempting to connect to private AWS ECR repositories #27014

Uh oh!

Uh oh!

Chilinot Feb 2, 2024

How are you running Renovate?

If you're self-hosting Renovate, tell us what version of Renovate you run.

If you're self-hosting Renovate, select which platform you are using.

Was this something which used to work for you, and then stopped?

Describe the problem

Relevant debug logs

Have you created a minimal reproduction repository?

Replies: 2 comments · 1 reply

Uh oh!

Uh oh!

Chilinot Feb 2, 2024 Author

Uh oh!

super-mcgin Jul 5, 2024

Uh oh!

Uh oh!

helenyugithub Jul 24, 2025

Chilinot
Feb 2, 2024

Replies: 2 comments 1 reply

Chilinot
Feb 2, 2024
Author

helenyugithub
Jul 24, 2025