Private registry authentication for tasks - Amazon ECS

Private registry authentication for tasks

Private registry authentication for tasks using AWS Secrets Manager enables you to store your credentials securely and then reference them in your container definition. This allows your tasks to use images from private repositories. This feature is supported by tasks using both the Fargate or EC2 launch types.


If your task definition references an image stored in Amazon ECR, this topic does not apply. For more information, see Using Amazon ECR Images with Amazon ECS in the Amazon Elastic Container Registry User Guide.

For tasks using the Fargate launch type, this feature requires platform version 1.2.0 or later. For information, see AWS Fargate platform versions.

Within your container definition, specify repositoryCredentials with the full ARN of the secret that you created. The secret you reference can be from a different Region than the task using it, but must be from within the same account.


When using the Amazon ECS API, AWS CLI, or AWS SDK, if the secret exists in the same Region as the task you are launching then you can use either the full ARN or name of the secret. When using the AWS Management Console, the full ARN of the secret must be specified.

The following is a snippet of a task definition showing the required parameters:

"containerDefinitions": [ { "image": "private-repo/private-image", "repositoryCredentials": { "credentialsParameter": "arn:aws:secretsmanager:region:aws_account_id:secret:secret_name" } } ]

Required IAM permissions for private registry authentication

The Amazon ECS task execution role is required to use this feature. This allows the container agent to pull the container image. For more information, see Amazon ECS task execution IAM role.

To provide access to the secrets that you create, manually add the following permissions as an inline policy to the task execution role. For more information, see Adding and Removing IAM Policies.

  • secretsmanager:GetSecretValue

  • kms:Decrypt—Required only if your key uses a custom KMS key and not the default key. The ARN for your custom key should be added as a resource.

An example inline policy adding the permissions is shown below.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Decrypt", "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:secretsmanager:<region>:<aws_account_id>:secret:secret_name", "arn:aws:kms:<region>:<aws_account_id>:key/key_id" ] } ] }

Enabling private registry authentication

To create a basic secret

Use AWS Secrets Manager to create a secret for your private registry credentials.

  1. Open the AWS Secrets Manager console at

  2. Choose Store a new secret.

  3. For Select secret type, choose Other type of secrets.

  4. Select Plaintext and enter your private registry credentials using the following format:

    { "username" : "privateRegistryUsername", "password" : "privateRegistryPassword" }
  5. Choose Next.

  6. For Secret name, type an optional path and name, such as production/MyAwesomeAppSecret or development/TestSecret, and choose Next. You can optionally add a description to help you remember the purpose of this secret later.

    The secret name must be ASCII letters, digits, or any of the following characters: /_+=.@-

  7. (Optional) At this point, you can configure rotation for your secret. For this procedure, leave it at Disable automatic rotation and choose Next.

    For information about how to configure rotation on new or existing secrets, see Rotating Your AWS Secrets Manager Secrets.

  8. Review your settings, and then choose Store secret to save everything you entered as a new secret in Secrets Manager.

To create a task definition that uses private registry authentication

  1. Open the Amazon ECS console at

  2. In the navigation pane, choose Task Definitions.

  3. On the task definitions page, choose Create new task definition.

  4. On the Select launch type compatibility page, choose the launch type for your tasks and then Next step.

  5. For task definition Name, type a name for your task definition. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed.

  6. For Task execution role, either select your existing task execution role or choose Create new role to have one created for you. This role authorizes Amazon ECS to pull private images for your task. For more information, see Required IAM permissions for private registry authentication.


    If the Task execution role field does not appear, choose Configure via JSON and manually add the executionRoleArn field to specify your task execution role. The following shows the syntax:

    "executionRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskExecutionRole"
  7. For each container to create in your task definition, complete the following steps:

    1. In the Container Definitions section, choose Add container.

    2. For Container name, type a name for your container. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed.

    3. For Image, type the image name or path to your private image. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed.

    4. Select the Private repository authentication option.

    5. For Secrets manager ARN, enter the full Amazon Resource Name (ARN) of the secret that you created earlier. The value must be between 20 and 2048 characters.

    6. Fill out the remaining required fields and any optional fields to use in your container definitions. More container definition parameters are available in the Advanced container configuration menu. For more information, see Task definition parameters.

    7. Choose Add.

  8. When your containers are added, choose Create.