Ecr community container successful but cant pull ecr image

I’m trying to get the community ecr credential updating container working, but having no luck at the moment.

The ecr container has logs of:
3/6/2017 12:23:04 PMUpdating ECR Credentials
3/6/2017 12:23:04 PMSuccessfully updated credentials 1c3 for registry 1sp1; registry address: 123123123.dkr.ecr.ap-southeast-2.amazonaws.com

But starting a stack that uses an image from that repo gives
Error (Image [123123123.dkr.ecr.ap-southeast-2.amazonaws.com/testrepo:testsite] failed to pull: Waiting)

I haven’t managed to find out where rancher stores the credentials it knows about, so I’ve not really got much to go on currently. - Has anyone else seen similar ?

(If i manually put some aws ecr registry credentials into rancher this works fine by the way)

seems to be working after i added a permission on the registry for the rancher iam user to pull. Not sure why it was working when manually entered, but oh well.