One way to store AWS ECR credentials is by specifying an executable command to the environment variable, so that the password will be queried for each recovery. This can be done by setting the SKYPILOT_DOCKER_PASSWORD environment variable to $(aws ecr get-login-password --region us-west-2). Another option is to pass the AWS secret key using the --env flag, but it may not work when using a Docker image in the resources section.