# Self-Healing CI: Recovering an ECR Token Expiry Mid-Push

> An ECR push that fails because the auth token expired mid-push is a timing issue, not bad credentials. See the manual fix and how self-healing CI re-auths and retries.

Source: https://latchkey.dev/learn/self-healing-ci/self-healing-ecr-token-expiry-mid-push  
Updated: 2026-06-26

An ECR push that turns unauthorized partway through hit a short-lived token expiring mid-transfer, not bad credentials -- re-authenticating and retrying clears it.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering an ECR token expiry Mid-Push?

A docker push to ECR fails with unauthorized partway through because the ECR auth token expired during a long push of large layers. The IAM credentials are valid; the short-lived token aged out mid-transfer. A human re-authenticates to ECR and re-runs the push and it completes unchanged.

### How do I fix Self-Healing CI: recovering an ECR token expiry Mid-Push manually?

[object Object]

### Can Self-Healing CI: recovering an ECR token expiry Mid-Push be fixed automatically?

A token expiry mid-push has a recognizable signature -- a 401 on credentials that are valid -- and a well-defined remedy: refresh the token and retry. A self-healing CI pipeline detects the auth-expiry condition, re-authenticates, retries the push (resuming completed layers), and only escalates if the credentials are genuinely rejected,

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt