eval aws ecr get-login should provide option to use password-stdin

[kojiromike]

The instructions are pretty clear that aws ecr get-login prints credentials. Since these credentials are designed to be used in an eval context, the password can be observed elsewhere on the machine.

$ eval "$(aws ecr get-login --no-include-email)"
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded

But recent versions of docker support a more secure approach using --password-stdin. You can use it now, but it's cumbersome:

$ read -sra cmd < <(aws ecr get-login --no-include-email)
$ pass="${cmd[5]}"
$ unset cmd[4] cmd[5]
$ "${cmd[@]}" --password-stdin <<< "$pass"
Login Succeeded

Or as a one-liner if you feel like manually composing the endpoint url:

$ aws ecr get-login --no-include-email | awk '{print $6}' | docker login -u AWS --password-stdin "$endpoint"
Login Succeeded

aws could support clean, secure docker login by providing more machine-parseable output, by providing a docker credentials-helper, or by providing the password separately from the rest of the command as in:

$ aws ecr get-password | eval "$(aws ecr get-login --password-stdin)"

[JordonPhillips]

The trick, potentially, is windows support, so something like that last bit may be necessary. In any case we should definitely support the stdin password feature.

[gonrial]

Duplicated #2875

[justnance]

@gonrial - Thanks for pointing out this is a duplicated. I'm going to close this issue so we can continue tracking the discussion under #2875.