ECR credentials for AWS using Vault

We've been trying to ascertain a clean way in which we can leverage Vault to provide credentials (or scripts or syntax) to a nomad job through the template, without physically colocating AWS keys/secrets onto the nomad host itself.

Is there no way to do this without touching the actual nomad server?

We'd like to be able to plan out job/tasks that cross over several ECR repositories, and private repos, not just one, and although we could put numerous profiles in the /root/.aws/credentials file, that pretty much defeats the use of Vault to keep this information out of people's hands.

We haven't found a clean way to do this.

Is this possible?

Existing cluster, already integrated with Vault. Leave it untouched. We have a new task that needs to pull the image from ECR.

No file, test, or entry point is named. Start by reviewing Nomad's existing Vault integration and the job configuration path for private ECR image pulls; done means establishing whether a supported approach can handle multiple private repositories without placing AWS credentials on the Nomad host.

Written by the indexing model from the issue text.