How to force BitBucket to push a Docker image to AWS ECR after a git tag

bitbucket-pipelines.yml

image: python:3.7.3

options:
  docker: true

pipelines:
  tags:
    'v*': # the tag is "vSomething" like "v0.4.3"
      - step:
         name: Build docker image and push to AWS ECR
         services:
           - docker
         caches:
           - pip
         script:
           # BitBucket > Settings > Pipelines > Repository variables =>
           #     AWS_ACCESS_KEY_ID=xxx
           #     AWS_SECRET_ACCESS_KEY=xxx
           #     AWS_REGION=xxx
           #     IMAGE_BASE_URL=xxx.dkr.ecr.eu-central-1.amazonaws.com # or something like that
           #     IMAGE_REPOSITORY=repo_name
           - pip install awscli
           - aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $IMAGE_BASE_URL
           - docker build -t $IMAGE_BASE_URL/$IMAGE_REPOSITORY:$BITBUCKET_TAG .
           - docker push $IMAGE_BASE_URL/$IMAGE_REPOSITORY