> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/archive/generic/hivel-on-premises-deployment-guide-generic/4.-aws-cli-configuration-hivel-ecr-access.md).

# 4. AWS CLI Configuration (Hivel ECR Access)

On-Prem Deployment Guide (Generic)

This section is not tied to your own infrastructure's cloud provider - it configures access to Hivel's registry, which lives in AWS regardless of where you deploy.

### Why AWS CLI Is Required

Hivel Docker images are stored in Hivel's Amazon Elastic Container Registry (ECR). To pull these images, you need:

1. AWS CLI configured with Hivel-provided credentials
2. Access to Hivel's ECR repository

The deployment process will automatically authenticate with ECR using AWS CLI to pull Docker images.

**Where these credentials come from:** the AWS Access Key ID and Secret Access Key you configure below are issued by Hivel, not by your own AWS/Azure/GCP account. They are scoped to Hivel's ECR repository only - they grant no access to any other AWS resource, and no AWS account of your own is required to use them. Treat them like any other credential: store them via aws configure (which writes to \~/.aws/credentials) or a secrets manager, not in a shared document.

**Rotating these credentials:** Hivel has not published a fixed rotation cadence for ECR pull credentials - contact your Hivel representative for the current process if you need to rotate them, including on demand ahead of a scheduled security review. The application database password, by contrast, is something you can rotate yourself without contacting Hivel - see Rotating the Application Database Password in Security and Secrets.

### Step 1: Configure AWS CLI

**Goal:** authenticate both servers against Hivel's container registry.

**Prerequisites:** AWS CLI installed (previous section); Hivel-provided Access Key ID and Secret Access Key on hand.

On both VM1 and VM2:

```
# Configure AWS CLI
aws configure
```

You will be prompted for:

* AWS Access Key ID: <mark style="color:$primary;">Hivel-provided access key</mark>
* AWS Secret Access Key: <mark style="color:$primary;">Hivel-provided secret key</mark>
* Default region name: <mark style="color:$primary;">Hivel's ECR region</mark>
* Default output format: `json`

**Expected result:** the prompt returns to your shell with no error after the four values are entered.

**If it fails:** re-run aws configure if you mistyped a value - it simply overwrites the previous entry.

### Step 2: Verify AWS CLI Configuration

```
# Test AWS CLI access
aws sts get-caller-identity
# This should return your AWS account details
```

**Expected result**: a JSON object containing an Account, UserId, and Arn - no error.

**If it fails:** Unable to locate credentials means aws configure wasn't completed or saved; re-run aws configure and confirm with cat \~/.aws/credentials.

### ECR Access Configuration

Hivel's Docker images are stored in ECR at:

730335373269.dkr.ecr.ap-south-1.amazonaws.com

To pull images, you need Hivel's AWS Access Key ID and Secret Access Key (provided by Hivel). These credentials have permissions scoped to Hivel's ECR repository only.

**Goal:** confirm you can actually pull Hivel's images, not just authenticate to AWS in general.

```
# Test ECR login
aws ecr get-login-password --region ap-south-1 | \
  docker login --username AWS --password-stdin \
  730335373269.dkr.ecr.ap-south-1.amazonaws.com
# Should show: Login Succeeded
```

> Note: The deployment script (deploy.sh) automatically handles ECR authentication using these credentials - no manual re-login is required during normal deployment.

**Expected result:** Login Succeeded.

**If it fails:** see ECR pull failed in [Troubleshooting](/archive/generic/hivel-on-premises-deployment-guide-generic/11.-troubleshooting.md).

**Next step:** Database Setup - provision the PostgreSQL database Hivel will use.

\ <br>

{% columns %}
{% column %} <a href="/archive/generic/hivel-on-premises-deployment-guide-generic/3.-infrastructure-setup.md" class="button primary" data-icon="backward">Infrastructure Setup</a>
{% endcolumn %}

{% column %}

{% endcolumn %}

{% column %} <a href="/archive/generic/hivel-on-premises-deployment-guide-generic/5.-database-and-project-setup.md" class="button primary" data-icon="forward">Database and Project Setup</a>
{% endcolumn %}
{% endcolumns %}