Both our Tower and our Wave installs are running as roles and can assume roles that have access to ECR repositories, but Wave is requiring we use an Access key and Secret key for an IAM user instead. Wave should use the roles it has available to it to authenticate to ECR.