How to fix Error response from daemon: failed to get awslogs credentials in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 135 views

This error occurs when the Docker daemon cannot authenticate with AWS CloudWatch Logs. The awslogs logging driver requires AWS credentials to be provided directly to the Docker daemon, not to individual containers.

Quick fix

Fixes Error response from daemon: failed to get awslogs credentials

aws sts get-caller-identity

Verify AWS credentials are working on the host
Configure credentials for the Docker daemon (Linux with systemd)
Use the shared credentials file for root user
Configure EC2 instance profile (recommended for AWS)

docker — error

$aws sts get-caller-identity
Error response from daemon: failed to get awslogs credentials

What this error means

The "failed to get awslogs credentials" error indicates that Docker's awslogs logging driver cannot find valid AWS credentials to authenticate with Amazon CloudWatch Logs. This is a common source of confusion because the credentials must be available to the Docker daemon itself, not to the container being run. When you configure a container to use the awslogs logging driver, the Docker daemon (not the container) is responsible for sending logs to CloudWatch. This means passing AWS credentials via environment variables to `docker run` or in your application code will not work. The daemon process needs direct access to credentials through one of three methods: environment variables set for the daemon service, the shared credentials file (~/.aws/credentials of the root user), or an EC2 instance profile. This error commonly appears when developers test locally with Docker Desktop, run Docker on on-premises servers without instance profiles, or misconfigure credential paths on Linux systems where the Docker daemon runs as a system service.

Typical symptoms

Container fails to start with 'failed to get awslogs credentials' error
Docker run command fails immediately when using --log-driver=awslogs
Docker Compose services with awslogs driver fail during startup
Error message includes 'NoCredentialProviders: no valid providers in chain'
Containers work fine with default logging but fail when awslogs is configured
AWS CLI works on the host machine but Docker awslogs still fails
Error occurs on local development machines but not on EC2 instances

Common causes

AWS credentials are not available to the Docker daemon process
Credentials were passed to the container instead of the daemon
The ~/.aws/credentials file is not accessible by the root user running Docker
Docker daemon environment variables are not set for AWS credentials
EC2 instance profile is not attached or lacks required permissions
Docker Desktop on Mac/Windows has limited access to host credentials
The IAM role or user lacks logs:CreateLogStream and logs:PutLogEvents permissions
Temporary credentials (AWS_SESSION_TOKEN) have expired

How to fix "Error response from daemon: failed to get awslogs credentials"

1Verify AWS credentials are working on the host

First, confirm that AWS credentials are properly configured on your system:

bash

aws sts get-caller-identity

This should return your AWS account ID and ARN. If this fails, configure credentials first:

bash

aws configure

Note: Even if this works, it doesn't mean Docker can access these credentials. The Docker daemon runs as a separate service and may not have access to your user's credentials.

2Configure credentials for the Docker daemon (Linux with systemd)

On Linux systems using systemd, create a drop-in configuration file to pass AWS credentials to the Docker daemon:

bash

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo nano /etc/systemd/system/docker.service.d/aws-credentials.conf

Add the following content:

ini

[Service]
Environment="AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY"
Environment="AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY"
Environment="AWS_DEFAULT_REGION=us-east-1"

Then reload systemd and restart Docker:

bash

sudo systemctl daemon-reload
sudo systemctl restart docker

Security note: This stores credentials in a system file. Consider using instance profiles or other secure methods for production environments.

3Use the shared credentials file for root user

The Docker daemon can read credentials from the root user's AWS credentials file. Create or copy credentials to /root/.aws/credentials:

bash

sudo mkdir -p /root/.aws
sudo nano /root/.aws/credentials

Add your credentials:

ini

[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
region = us-east-1

Set proper permissions:

bash

sudo chmod 600 /root/.aws/credentials
sudo chmod 700 /root/.aws

Restart Docker to pick up the credentials:

bash

sudo systemctl restart docker

4Configure EC2 instance profile (recommended for AWS)

If running on EC2, the best practice is to use an instance profile with an IAM role. First, create an IAM role with this policy:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

Attach the role to your EC2 instance:

1. Go to EC2 Console > Instances
2. Select your instance
3. Actions > Security > Modify IAM role
4. Select or create an instance profile with the above policy

The Docker daemon automatically detects and uses instance profile credentials. No restart is needed.

5Handle on-premises or non-EC2 environments

For servers outside AWS, disable EC2 metadata lookup to prevent timeout delays and ensure file-based credentials are used:

Using Docker run:

bash

docker run \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=my-log-group \
  -e AWS_EC2_METADATA_DISABLED=true \
  your-image

Using Docker Compose:

yaml

version: '3.8'
services:
  app:
    image: your-image
    environment:
      - AWS_EC2_METADATA_DISABLED=true
    logging:
      driver: awslogs
      options:
        awslogs-region: us-east-1
        awslogs-group: my-log-group
        awslogs-stream: my-log-stream

Ensure the Docker daemon has credentials configured via the systemd or root credentials file methods described above.

6Configure Docker Desktop (Mac/Windows)

Docker Desktop runs in a VM, making credential access more complex. There are several approaches:

Option 1: Mount credentials volume (Docker Compose)

yaml

version: '3.8'
services:
  app:
    image: your-image
    volumes:
      - ~/.aws:/root/.aws:ro
    environment:
      - AWS_EC2_METADATA_DISABLED=true
    logging:
      driver: awslogs
      options:
        awslogs-region: us-east-1
        awslogs-group: my-log-group

Option 2: Use a log aggregator container
Instead of the awslogs driver, use a sidecar container that forwards logs to CloudWatch and can receive credentials normally.

Option 3: Local development alternative
For local development, consider using the default json-file driver and only enabling awslogs in production:

yaml

logging:
  driver: "${LOG_DRIVER:-json-file}"
  options:
    awslogs-region: us-east-1
    awslogs-group: my-log-group

7Verify the CloudWatch log group exists

The awslogs driver requires the log group to exist unless you enable automatic creation. Check if your log group exists:

bash

aws logs describe-log-groups --log-group-name-prefix my-log-group

If it doesn't exist, create it:

bash

aws logs create-log-group --log-group-name my-log-group --region us-east-1

Or enable automatic creation with the awslogs-create-group option:

bash

docker run \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=my-log-group \
  --log-opt awslogs-create-group=true \
  your-image

Note: Using awslogs-create-group requires the logs:CreateLogGroup IAM permission.

8Test the configuration

Run a simple container to verify awslogs is working:

bash

docker run --rm \
  --log-driver=awslogs \
  --log-opt awslogs-region=us-east-1 \
  --log-opt awslogs-group=test-log-group \
  --log-opt awslogs-stream=test-stream \
  alpine echo "Hello CloudWatch"

If successful, verify the log appeared in CloudWatch:

bash

aws logs get-log-events \
  --log-group-name test-log-group \
  --log-stream-name test-stream \
  --region us-east-1

You should see "Hello CloudWatch" in the events.

Advanced notes

Understanding credential resolution order: The Docker daemon checks for credentials in this order: (1) Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), (2) Shared credentials file (~/.aws/credentials of the user running Docker, typically root), (3) EC2 instance profile. The daemon uses the first valid credentials found.

Session tokens and temporary credentials: If using AWS SSO, assumed roles, or temporary credentials, you must also include AWS_SESSION_TOKEN. These credentials expire and must be refreshed. For long-running Docker daemons, instance profiles are preferred as they automatically refresh credentials.

Region detection: On EC2 instances, the awslogs driver automatically detects the region from instance metadata. On other systems, you must specify awslogs-region explicitly. Without a region, you'll get a different error about missing region configuration.

Debugging credential issues: Enable Docker daemon debug logging to see credential resolution attempts:

bash

# Edit /etc/docker/daemon.json
{
  "debug": true
}
# Restart Docker and check logs
sudo journalctl -u docker -f

ECS and Fargate considerations: When running on ECS or Fargate, the task execution role provides credentials automatically. You don't need to configure credentials manually - just ensure the task execution role has the required CloudWatch Logs permissions.

Container-level credential workarounds: Some users work around the daemon credential requirement by running a log forwarder container (like Fluentd or Fluent Bit) that receives logs from other containers via a shared volume or network and forwards them to CloudWatch. This approach lets you pass credentials to the forwarder container normally.

Credential security best practices:
- Never commit credentials to source control
- Use instance profiles or ECS task roles in production
- Rotate credentials regularly
- Use IAM roles with minimal required permissions
- Consider AWS Secrets Manager for credential rotation

Alternative logging solutions: If awslogs proves problematic, consider:
- Fluent Bit with CloudWatch output plugin
- CloudWatch Agent running on the host
- Third-party log aggregation services that support Docker natively

Frequently asked questions

What does "Error response from daemon: failed to get awslogs credentials" mean?: The "failed to get awslogs credentials" error indicates that Docker's awslogs logging driver cannot find valid AWS credentials to authenticate with Amazon CloudWatch Logs. This is a common source of confusion because the credentials must be available to the Docker daemon itself, not to the container being run. When you configure a container to use the awslogs logging driver, the Docker daemon (not the container) is responsible for sending logs to CloudWatch.
How do I fix "Error response from daemon: failed to get awslogs credentials"?: This error occurs when the Docker daemon cannot authenticate with AWS CloudWatch Logs. The awslogs logging driver requires AWS credentials to be provided directly to the Docker daemon, not to individual containers.
What causes "Error response from daemon: failed to get awslogs credentials"?: AWS credentials are not available to the Docker daemon process Credentials were passed to the container instead of the daemon The ~/.aws/credentials file is not accessible by the root user running Docker
Is the "Error response from daemon: failed to get awslogs credentials" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Docker Official Documentation
📖
Docker Docs: Amazon CloudWatch Logs logging driver(Official Docs)
💬
Stack Overflow: How to provide credentials to awslogs driver(Stack Overflow)
💬
Stack Overflow: Docker awslogs NoCredentialProviders error(Stack Overflow)
🔗
AWS re:Post: awslogs driver credentials on on-premises server
📝
Pass Credentials to the awslogs Docker Logging Driver on Ubuntu
🐙
GitHub: docker/compose NoCredentialProviders issue(GitHub)
📝
Dev.to: 100 Common Docker Errors & Solutions

How to fix Error response from daemon: failed to get awslogs credentials in Docker

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "Error response from daemon: failed to get awslogs credentials"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading