In my case it was also an AWS S3 GET (same as with https://stackoverflow.com/users/280292/oden) that I had configured through policies, but I made a mistake in the referrer section. I wrote "StringEquals" : "mydomain.com" and it should have been "StringLike" : "mydomain.com/*". Sharing just in case it's useful to anyone.