agent/dockerclient/dockerauth/ecr.go
func (authProvider *ecrAuthProvider) GetAuthconfig(image string,
	registryAuthData *apicontainer.RegistryAuthenticationData) (types.AuthConfig, error) {

	if registryAuthData == nil {
		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's registry auth data")
	}

	authData := registryAuthData.ECRAuthData

	if authData == nil {
		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's ecr auth data")
	}

	// First try to get the token from cache, if the token does not exist,
	// then call ECR api to get the new token
	key := cacheKey{
		region:           authData.Region,
		endpointOverride: authData.EndpointOverride,
		registryID:       authData.RegistryID,
	}

	// If the container is using execution role credentials to pull,
	// add the roleARN as part of the cache key so that docker auth for
	// containers pull with the same role can be cached
	if authData.GetPullCredentials() != (credentials.IAMRoleCredentials{}) {
		key.roleARN = authData.GetPullCredentials().RoleArn
	}

	// Try to get the auth config from cache
	auth := authProvider.getAuthConfigFromCache(key)
	if auth != nil {
		return *auth, nil
	}

	// Get the auth config from ECR
	return authProvider.getAuthConfigFromECR(image, key, authData)
}
func (authProvider *ecrAuthProvider) GetAuthconfig(image string,
	registryAuthData *apicontainer.RegistryAuthenticationData) (types.AuthConfig, error) {

	if registryAuthData == nil {
		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's registry auth data")
	}

	authData := registryAuthData.ECRAuthData

	if authData == nil {
		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's ecr auth data")
	}

	// First try to get the token from cache, if the token does not exist,
	// then call ECR api to get the new token
	key := cacheKey{
		region:           authData.Region,
		endpointOverride: authData.EndpointOverride,
		registryID:       authData.RegistryID,
	}

	// If the container is using execution role credentials to pull,
	// add the roleARN as part of the cache key so that docker auth for
	// containers pull with the same role can be cached
	if authData.GetPullCredentials() != (credentials.IAMRoleCredentials{}) {
		key.roleARN = authData.GetPullCredentials().RoleArn
	}

	// Try to get the auth config from cache
	auth := authProvider.getAuthConfigFromCache(key)
	if auth != nil {
		return *auth, nil
	}

	// Get the auth config from ECR
	return authProvider.getAuthConfigFromECR(image, key, authData)
}
// GetAuthconfig retrieves the correct auth configuration for the given repository