What are the required policies for a IAM user that does a Serverless deployment to AWS Lambda?

Question

I was trying to do a simple deployment — no external resources at all — from a limited-role user, and spent three hours futzing with IAM, ending up granting the “limited” us