The CodeBuild service role lacks permissions to obtain an ECR authorization token and push images is the most likely cause because the pipeline reports an authorization failure during the final push to Amazon ECR.

The build project uses its service role to call Amazon ECR for authentication and to perform repository operations so if the role does not have the necessary permissions such as ecr:GetAuthorizationToken and the push related actions like ecr:PutImage and the layer upload permissions the docker push will fail with an authorization error rather than a network timeout.

Security group rules prevent CodeBuild from reaching Amazon ECR is unlikely because an authorization error points to credential or IAM policy problems and not to connectivity failures which usually show as connection timeouts or refusals.

The ECS cluster instances need extra configuration added to /etc/ecs/ecs.config is unrelated because the failure occurs in the build stage when publishing the image to ECR and not on the ECS runtime hosts.

The build environment’s VPC is missing Amazon ECR interface VPC endpoints would manifest as network reachability errors when builds run in private subnets without outbound access and not as a clear authorization error tied to missing IAM permissions.

Full AWS Practitioner Certification Question