Push to ECR registry fails with "Error: buildx failed with: ERROR: failed to solve: failed to push ** 403 Forbidden"

[nivetaiyer]

I'm trying to push an image with caching to my ECR repository. Caching succeeds but the push fails with 403 Forbidden. Here's the workflow:

jobs:
  push_to_registry:
    name: Push Docker image to ECR
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Check out the repo
        uses: actions/checkout@v3.5.3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: xx/GitHubAction-AssumeRoleWithAction
          aws-region: us-west-1

      - name: Log in to AWS ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: |
            ${{ steps.login-ecr.outputs.registry }}/repo_name
          tags: |
            type=semver,pattern={{version}},value=1.0.0
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}

      - name: Build image
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

Error :

buildx failed with: ERROR: failed to solve: failed to push ***.dkr.ecr.us-west-1.amazonaws.com/repo_name:1.0.0: unexpected status from HEAD request to https://***.dkr.ecr.us-west-1.amazonaws.com/v2/repo_name/manifests/1.0.0: 403 Forbidden

I've verified that manually building and pushing the docker file works (i.e. without using build-push-action) so it's not an AWS permissions issue.

[alaugks]

I have a similar issue. The image is built, pushed to Dockerhub and the image also works.

buildx failed with: ERROR: failed to solve: error writing layer blob: push access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

[Bozydarek]

Today I stumbled upon the same issue. The docker buildx build … --push command failed with the same error message (unexpected status from HEAD request to <URL>: 403 Forbidden). But docker push was working uninterrupted. It turns out that buildix required one additional AWS ECR permission - ecr:BatchGetImage. 🙃

[alaugks]

I think it is an AWS ECR problem. One day later, the error no longer occurred.

[1mono2]

Thank you! This comment saved my time.