no basic auth credentials

WHAT IT MEANS

What this error means

ECR uses short-lived authorization tokens as Docker registry credentials. no basic auth credentials comes from the Docker client: it had no credential for the registry host it was talking to. During sam deploy of an image-packaged function (or any docker push step in CI), the usual causes are:

• No login step ran. The job pushed without ever calling aws ecr get-login-password / amazon-ecr-login.
• The token expired. ECR tokens last 12 hours; a login performed at the start of a very long pipeline is stale by push time. The sibling message here is Your authorization token has expired. Reauthenticate and try again.
• Wrong registry host. The login targeted one account/Region registry and the push targeted another — the credential exists but not for that host.
• The identity cannot mint tokens. The deploy role lacks ecr:GetAuthorizationToken, so the login step itself failed earlier (check for not authorized to perform: ecr:GetAuthorizationToken above this line).

FIX

How to fix it

1. Add (or move) an explicit login step before the push:

   # GitHub Actions
   - uses: aws-actions/amazon-ecr-login@v2
   
   # shell
   aws ecr get-login-password --region YOUR_REGION | \
     docker login --username AWS --password-stdin \
     ACCOUNT_ID.dkr.ecr.YOUR_REGION.amazonaws.com

2. Match the registry exactly. The account ID and Region in the login command must be the ones in the image URI being pushed. Cross-account pushes need the login against the target account's registry.
3. Re-authenticate inside long jobs. If a pipeline can run near or past 12 hours — or reuses a warm runner — log in immediately before the push instead of once at job start.
4. Grant the token permission. The deploy identity needs ecr:GetAuthorizationToken (its resource is always *) plus repository-scoped push permissions: ecr:BatchCheckLayerAvailability, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:PutImage on the exact repository ARN.
5. Then retry the push. If the push now fails with a denied message instead, that is a repository policy or IAM problem, not authentication.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes no basic auth credentials, the expired ECR authorization token, and the missing ecr:GetAuthorizationToken permission (high confidence), and distinguishes runner-side push auth from Lambda-side image pull failures. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• Cannot connect to the Docker daemon — the build never got far enough to push.
• The security token included in the request is expired — the AWS-credential (not registry-token) version of expiry.
• Not authorized to perform: sts:AssumeRoleWithWebIdentity — the job has no AWS identity at all.