How to fix Error response from daemon: failed to get awslogs credentials in Docker

First, confirm that AWS credentials are properly configured on your system:

aws sts get-caller-identity

This should return your AWS account ID and ARN. If this fails, configure credentials first:

aws configure

Note: Even if this works, it doesn't mean Docker can access these credentials. The Docker daemon runs as a separate service and may not have access to your user's credentials.

On Linux systems using systemd, create a drop-in configuration file to pass AWS credentials to the Docker daemon:

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo nano /etc/systemd/system/docker.service.d/aws-credentials.conf

Add the following content:

[Service]
Environment="AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY"
Environment="AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY"
Environment="AWS_DEFAULT_REGION=us-east-1"

Then reload systemd and restart Docker:

sudo systemctl daemon-reload
sudo systemctl restart docker

Security note: This stores credentials in a system file. Consider using instance profiles or other secure methods for production environments.

The Docker daemon can read credentials from the root user's AWS credentials file. Create or copy credentials to /root/.aws/credentials:

sudo mkdir -p /root/.aws
sudo nano /root/.aws/credentials

Add your credentials:

[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
region = us-east-1

Set proper permissions:

sudo chmod 600 /root/.aws/credentials
sudo chmod 700 /root/.aws

Restart Docker to pick up the credentials:

sudo systemctl restart docker

If running on EC2, the best practice is to use an instance profile with an IAM role. First, create an IAM role with this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

Attach the role to your EC2 instance:

1. Go to EC2 Console > Instances
2. Select your instance
3. Actions > Security > Modify IAM role
4. Select or create an instance profile with the above policy

The Docker daemon automatically detects and uses instance profile credentials. No restart is needed.

For servers outside AWS, disable EC2 metadata lookup to prevent timeout delays and ensure file-based credentials are used:

Using Docker run:

docker run \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=my-log-group \
  -e AWS_EC2_METADATA_DISABLED=true \
  your-image

Using Docker Compose:

version: '3.8'
services:
  app:
    image: your-image
    environment:
      - AWS_EC2_METADATA_DISABLED=true
    logging:
      driver: awslogs
      options:
        awslogs-region: us-east-1
        awslogs-group: my-log-group
        awslogs-stream: my-log-stream

Ensure the Docker daemon has credentials configured via the systemd or root credentials file methods described above.

Docker Desktop runs in a VM, making credential access more complex. There are several approaches:

Option 1: Mount credentials volume (Docker Compose)

version: '3.8'
services:
  app:
    image: your-image
    volumes:
      - ~/.aws:/root/.aws:ro
    environment:
      - AWS_EC2_METADATA_DISABLED=true
    logging:
      driver: awslogs
      options:
        awslogs-region: us-east-1
        awslogs-group: my-log-group

Option 2: Use a log aggregator container
Instead of the awslogs driver, use a sidecar container that forwards logs to CloudWatch and can receive credentials normally.

Option 3: Local development alternative
For local development, consider using the default json-file driver and only enabling awslogs in production:

logging:
  driver: "${LOG_DRIVER:-json-file}"
  options:
    awslogs-region: us-east-1
    awslogs-group: my-log-group

The awslogs driver requires the log group to exist unless you enable automatic creation. Check if your log group exists:

aws logs describe-log-groups --log-group-name-prefix my-log-group

If it doesn't exist, create it:

aws logs create-log-group --log-group-name my-log-group --region us-east-1

Or enable automatic creation with the awslogs-create-group option:

docker run \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=my-log-group \
  --log-opt awslogs-create-group=true \
  your-image

Note: Using awslogs-create-group requires the logs:CreateLogGroup IAM permission.

Run a simple container to verify awslogs is working:

docker run --rm \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=test-log-group \
  --log-opt awslogs-stream=test-stream \
  alpine echo "Hello CloudWatch"

If successful, verify the log appeared in CloudWatch:

aws logs get-log-events \
  --log-group-name test-log-group \
  --log-stream-name test-stream \
  --region us-east-1

You should see "Hello CloudWatch" in the events.