# How can an OCIRepository authenticate to Amazon ECR without a static registry password?

Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/how-can-an-ocirepository-authenticate-to-amazon-ecr-without-a-static-registry-password

- A. Set spec.secretRef to the ARN of the node's IAM role
- B. Set spec.insecure: true so no credentials are needed
- C. Set spec.provider: aws so source-controller uses the cloud identity
- D. Set spec.provider: generic and grant the node's IAM role access to ECR

**Answer:** Set spec.provider: aws so source-controller uses the cloud identity

**Explanation:** With provider aws, azure or gcp, source-controller gets registry credentials from the cloud's workload identity instead of a Secret. The default, generic, uses a Secret or anonymous access. ImageRepository supports the same provider field for scanning private registries.