Forbidden! ECR Serverless Script

Serverless Framework
,
1

I am able to create an ECR Repository using the CLI.

However this serverless script fails

# ecr/serverless.yml
service: service-ecr

useDotenv: true

provider:
  name: aws
  region: ${env:REGION}

resources:
  Resources:
    ECRRepo:
      Type: AWS::ECR::Repository
      Properties: 
        RepositoryName: ${env:REPOSITORY_NAME}

I get this in the log

ecr-service › Credentials: Local, "default" profile
ecr-service › Docs:        docs.serverless.com
ecr-service › Support:     forum.serverless.com
ecr-service › Bugs:        github.com/serverless/serverless/issues
ecr-service › Error:
ecr-service › Forbidden
ecr-service › error
ecr-service › Error:
ecr-service › Forbidden
ecr-service ›

Any ideas?
How can I get better error messages?

2

Now getting “Access Denied”.

Still no useful error output. Nothing in Cloudwatch.

3

Seems like a pretty basic problem for there to be no answers for.
What is the minimum list of permissions for a basic serverless stack (say to create just an S3 bucket)?
How do you get better error messages so you can troubleshoot?