Drone-ECR authentication

The documentation for drone-ecr is somewhat lacking: http://plugins.drone.io/drone-plugins/drone-ecr/

Specifically:

steps:
- name: publish  
  image: plugins/ecr
  settings:
    access_key:
      from_secret: aws_access_key_id
    secret_key:
      from_secret: aws_secret_access_key

A Kubernetes secret has a name and a set of key=value pairs. I cannot find anywhere in the docs (and skimming the source code) what the full format should be. Is aws_access_key_id the key of a secret with a magic name? Or is aws_access_key_id the name of a secret that should contain a magic key name?

Also tried adding permissions so the pod is able to access ECR without keys but to no avail.

see https://docs.drone.io/configure/secrets/repository/

Aha. Will try that. Thanks!