A CodeBuild project builds a Docker image and previously uploaded images to S3; you migrated to Amazon ECR and updated the project role and docker commands, but the build fails when attempting to access ECR. What change will fix the ECR authentication failure?

The correct solution is to explicitly authenticate Docker to ECR within the buildspec.yml. aws ecr get-login-password retrieves a temporary authentication token, which is then piped to docker login to allow Docker to push and pull images from ECR. This is a standard and secure method for ECR authentication in CI/CD pipelines. Incorrect options: Adding a Secrets Manager environment variable containing the service role ARN is not how ECR authentication works. docker login requires a username and password/token, not an ARN. Making the ECR repository public is a security risk and generally not recommended for private images. While it would resolve access issues, it's not a secure solution. Using the AWS CLI to assume the service role for ECR actions is unnecessary. The CodeBuild service role already has permissions to interact with ECR if configured correctly, but Docker itself still needs to be authenticated with ECR.