AWS S3 PutObject 403 forbidden to bucket via CanonicalUserPrincipal from Cloudfront

Question

I have a Cloudfront distribution with 2 buckets that are not publicly accessible. The first bucket is the App bucket, with the app source code. The second bucket (the culpri