It turned out that I was not accessing the bucket that I thought due to a missing environment variable causing a default bucket name to be used. Unfortunately, the default bucket name turned out to be a real bucket registered by a different AWS account in a different region. The AWS error message is therefore correct, but the problem would have been more obvious had the error message included the name of the bucket for which access is denied.

The environment variable was defined locally, and so did not affect my local development machine - only the deployed instance was affected. Be sure to print the bucket name before calling the SDK to be sure that 'the resource' to which access is denied is as expected.