Exact s3 Bucket settings for AppStream Elastic Fleet AppBlock

I am trying to get an Elastic AppStream Fleet running. I've followed the tutorials and workshop but the app has a blank screen on startup. It looks like the Instance is not downloading the files from my s3 bucket.

I've set the fleet to desktop for troubleshooting. The "C:\AppStream\AppBlocks\my-app" folder is created, but it is empty.

To create the s3 bucket I created a default bucket: Block all public access is On. Ownership is Bucket Owner Enforced. ACL has bucket owner List,Write/Read,Write

I created a bucket policy as described:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowRetrievalPermissionsToS3AppsForAppStream",
            "Effect": "Allow",
            "Principal": {
                "Service": "appstream.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-app/*"
        }
    ]
}

I then copied in the vhdx, script and icon files from my local PC (not from the ImageCreator instance) using the "Upload" button in the my-app bucket.

If I create a presigned URL for an object, I can access it within the AppStream instance. If I try a direct connection to the object URL (https://my-app.s3.ap-southeast-2.amazonaws.com/icon.png) in the AppStream instance I get "Access Denied" XML error message. I turned on logging for the bucket, but I don't seem to get any logs.

I desperately need to get this working for proof of concept testing. I've spent hours on this over the last few days and have recreated the entire setup multiple times to no avail.

Can someone please help me with the correct permission settings for my bucket so this will work, or else tell me how I can view logs which will give me the exact error messages so I can follow on from there?