Googling I found Cloudfront to s3 redirect to subdomain giving Access denied error which seems to be same issue.
In my case, I have www.example.com redirect to example.com
The CloudFront origin name selected from list was www.example.com.s3.amazonaws.com and I edited to be www.example.com.s3-website-us-east-1.amazonaws.com
But still get error when I visit www.example.com
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>xxxxx</RequestId>
<HostId>yyyyyyyyyyy</HostId>
</Error>
Opening www.example.com.s3-website-us-east-1.amazonaws.com in browser does the redirect properly
Opening
xxxxxxx.cloudfront.net gives same error, so I assume the issue issue is with cloudfront