how to pull docker image on ECR using cloudformation template

Using ECR, EC2 and docker, you are still required to do a docker login.

In the user data run

aws ecr get-login --no-include-email > login.sh

bash login.sh

then you should be able to run

docker pull ecr_registry/repo:tag

https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_AWSCLI.html