# Forbidden! ECR Serverless Script

**URL:** https://forum.serverless.com/t/forbidden-ecr-serverless-script/17377
**Category:** Serverless Framework
**Tags:** aws, cloudformation
**Created:** [July 1, 2022, 12:20pm UTC](https://forum.serverless.com/t/forbidden-ecr-serverless-script/17377 "2022-07-01T12:20:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![suityou01](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@suityou01](https://forum.serverless.com/u/suityou01)
#### Post date: [July 1, 2022, 12:20pm UTC](https://forum.serverless.com/t/forbidden-ecr-serverless-script/17377/1 "2022-07-01T12:20:56Z")

</div>

I am able to create an ECR Repository using the CLI.

However this serverless script fails

```auto
# ecr/serverless.yml
service: service-ecr

useDotenv: true

provider:
  name: aws
  region: ${env:REGION}

resources:
  Resources:
    ECRRepo:
      Type: AWS::ECR::Repository
      Properties: 
        RepositoryName: ${env:REPOSITORY_NAME}
   

```

I get this in the log

```auto
ecr-service › Credentials: Local, "default" profile
ecr-service › Docs: docs.serverless.com
ecr-service › Support: forum.serverless.com
ecr-service › Bugs: github.com/serverless/serverless/issues
ecr-service › Error:
ecr-service › Forbidden
ecr-service › error
ecr-service › Error:
ecr-service › Forbidden
ecr-service › 

```

Any ideas?  
How can I get better error messages?

---

<div class="post-metadata">

### Author: ![suityou01](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@suityou01](https://forum.serverless.com/u/suityou01)
#### Post date: [July 1, 2022, 2:00pm UTC](https://forum.serverless.com/t/forbidden-ecr-serverless-script/17377/2 "2022-07-01T14:00:39Z")

</div>

Now getting “Access Denied”.

Still no useful error output. Nothing in Cloudwatch.

---

<div class="post-metadata">

### Author: ![suityou01](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@suityou01](https://forum.serverless.com/u/suityou01)
#### Post date: [July 4, 2022, 10:06am UTC](https://forum.serverless.com/t/forbidden-ecr-serverless-script/17377/3 "2022-07-04T10:06:10Z")

</div>

Seems like a pretty basic problem for there to be no answers for.  
What is the minimum list of permissions for a basic serverless stack (say to create just an S3 bucket)?  
How do you get better error messages so you can troubleshoot?