Fix: CI/CD Docker Push Access Denied

!Symptoms

• docker push fails with 'denied: requested access to the resource is denied'
• CI pipeline fails at image push step
• Authentication to container registry fails in automation

?Root Causes

• Docker login credentials expired or not configured in CI
• CI environment variable for registry token is empty or wrong
• IAM role for ECR does not have push permissions
• Repository does not exist in the registry (ECR requires pre-creation)
• Wrong registry URL in the image tag

#Diagnosis Steps

1. 1Check the full error message in CI logs for which registry and repo
2. 2Verify CI secrets are set: check repository/organization secrets settings
3. 3For ECR: check IAM policy allows ecr:PutImage, ecr:InitiateLayerUpload, etc.
4. 4Test login manually: `docker login <registry>` with the same credentials
5. 5Verify the repository exists: `aws ecr describe-repositories` for ECR

>Fix

1. 1Update or add registry credentials as CI secrets
2. 2For ECR: get login token: `aws ecr get-login-password | docker login --username AWS --password-stdin <account>.dkr.ecr.<region>.amazonaws.com`
3. 3Create the repository if it does not exist: `aws ecr create-repository --repository-name <name>`
4. 4Fix the image tag to include the correct registry URL
5. 5Grant push permissions to the CI service account or IAM role

*Prevention

• Use OIDC authentication between CI and cloud providers (no static credentials)
• Automate ECR repository creation in Terraform alongside the service
• Set up credential rotation reminders or use short-lived tokens
• Test registry authentication as the first step in CI pipelines
• Use GitHub Actions OIDC with aws-actions/configure-aws-credentials

Related Error Messages