"Access Denied" on Signed URL from S3

I've been following the documentation on how to configure an S3 resource.
Created a Query to Read a file -- works S3 file key: "xyz.png"
Created a query to get a Signed URL -- "Access Denied" { Key: "xyz.png"}
We wrote a quick code in Node to fetch that same resource -- works (see below)

const {GetObjectCommand, S3Client} = require("@aws-sdk/client-s3");
const {fromIni} = require("@aws-sdk/credential-providers");
const {getSignedUrl} = require("@aws-sdk/s3-request-presigner");

const createPresignedUrlWithClient = ({region, bucket, key}) => {
  const client = new S3Client({
    credentials: fromIni(),
  const command = new GetObjectCommand({Bucket: bucket, Key: key});
  return getSignedUrl(client, command, {expiresIn: 3600});

Anyone has an idea what is wrong?

Hey @Boaz_Zimmerman, is the query that generates the signed URL returning access denied? Or do you see that when attempting to use the generated URL?

Are you using any specific encryption for you bucket objects?