Authenticates to ECR without exposing password to other processes.

ecr_auth.sh

#!/bin/bash -e

AWS_ACCOUNT=
AWS_REGION=us-east-1
ECR_URL=https://${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com

# On Mac, replace "base64 -d" with "base64 -D".
aws ecr get-authorization-token --query authorizationData[].authorizationToken --output text | base64 -d | cut -d: -f2 \
  | docker login -u AWS --password-stdin ${ECR_URL} \
  || echo "Failed to authenticate to ECR." && exit 1

# Alternative
aws ecr get-login --no-include-email --region ${AWS_REGION} | awk '{printf $6}' \
  | docker login -u AWS --password-stdin ${ECR_URL} \
  || echo "Failed to authenticate to ECR." && exit 1

See related aws/aws-cli#2875