Hey, I couldn't figure out how to do it with Prefect Blocks. I ended up using a IAM user with ECR access with permanent credentials so it wouldn't expire. I use Ubuntu Docker hosts to run my flow code, so I put those credentials in the ~/.aws/credentials files and used
https://github.com/awslabs/amazon-ecr-credential-helper so it doesn't have to authenticate to the ECR in Docker first with the command anymore. Then when Prefect runs a flow on my Ubuntu hosts, it is set to pull the docker image down automatically and it works because of the way I set it up above. Hope that helps.