Gitlab CI/CD连接AWS ECR报错：aws命令未找到及非TTY登录问题

问题描述 #

使用GitLab CI/CD时，Runner连接AWS ECR授权失败，流水线报错。本地终端授权正常，排除登录信息和AWS策略问题，推测为CI配置或镜像依赖问题。

现有.gitlab-ci.yaml配置 #

stages:
  - build
  - deploy

build_and_push_docker:
  stage: build
  image: docker:19.03.12
  script:
    - docker build -t repo-image .
    - docker tag ata-repo-image:latest $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
    - echo $AWS_ACCESS_KEY_ID | docker login -u AWS --password-stdin https://$AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
    - docker push $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest

download_signed_files_from_ecr:
  stage: deploy
  image: amazon/aws-cli:latest
  entrypoint: ["/bin/sh", "-c"]
  script:
    - aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
    - aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
    - aws configure set default.region us-east-1
    - docker pull $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
    - docker run --rm -v $(pwd):/downloads $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest cp /var/www/html/signed/*.deb /downloads/
  artifacts:
    paths:
      - /downloads
  only:
    - master

报错信息 #

$ docker tag ata-repo-image:latest $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
$ aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
/bin/sh: eval: line 139: aws: not found
Error: Cannot perform an interactive login from a non TTY device
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit code 1

解决方法 #

1. 修复Build阶段的AWS CLI缺失问题 #

docker:19.03.12镜像默认未安装AWS CLI，导致aws命令找不到；同时原配置存在镜像标签名称不匹配的问题，需一并修正：

修改后的build_and_push_docker job：

build_and_push_docker:
  stage: build
  image: docker:19.03.12
  services:
    - docker:19.03.12-dind  # 启用Docker-in-Docker服务，确保docker命令正常运行
  script:
    - apk add --no-cache aws-cli  # 在Alpine镜像中安装AWS CLI
    - docker build -t repo-image .
    - docker tag repo-image:latest $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest  # 统一镜像名称，与build结果匹配
    - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
    - docker push $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"

2. 修复Deploy阶段的Docker缺失问题 #

amazon/aws-cli:latest镜像未安装Docker，无法执行docker pull和docker run命令，可通过两种方式解决：

方式一：在Deploy阶段安装Docker

download_signed_files_from_ecr:
  stage: deploy
  image: amazon/aws-cli:latest
  entrypoint: ["/bin/sh", "-c"]
  script:
    - yum install -y docker  # 在Amazon Linux镜像中安装Docker
    - service docker start
    - aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
    - aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
    - aws configure set default.region us-east-1
    - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
    - docker pull $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
    - docker run --rm -v $(pwd):/downloads $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest cp /var/www/html/signed/*.deb /downloads/
  artifacts:
    paths:
      - *.deb  # 修正artifacts路径，指向工作目录下的deb文件
  only:
    - master

方式二：改用包含Docker和AWS CLI的镜像

download_signed_files_from_ecr:
  stage: deploy
  image: docker:19.03.12
  script:
    - apk add --no-cache aws-cli
    - aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
    - aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
    - aws configure set default.region us-east-1
    - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
    - docker pull $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest
    - docker run --rm -v $(pwd):/downloads $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/repo:latest cp /var/www/html/signed/*.deb /downloads/
  artifacts:
    paths:
      - *.deb
  only:
    - master

3. 额外配置检查 #

• 确认GitLab项目的CI/CD变量中已正确设置AWS_ACCOUNT_ID、AWS_ACCESS_KEY_ID、AWS_SECRET_ACCESS_KEY，变量类型为Variable。
• 若使用共享Runner，需确保Runner配置中已开启privileged: true，支持Docker-in-Docker运行。

内容的提问来源于stack exchange，提问作者user15369337