How can I find what S3 buckets are required by a service?

I'm using WorkSpaces Web (not WorkSpaces!) with an S3 VPC endpoint. I would like to be able to restrict S3 access via the S3 endpoint policy to only the buckets required by WorkSpaces Web. I cannot find any documentation with the answers, and AWS support does not seem to know what these buckets are. How can I find out what buckets the service is talking to? I see the requests in VPC flow logs, but that obviously doesn't show what URL or bucket it is trying to talk to. I have tried the same policy used for WorkSpaces (below), but it was not correct (or possibly not enough). I have confirmed that s3:GetObject is the only action needed.

{
	"Version": "2008-10-17",
	"Statement": [
		{
			"Sid": "Access-to-specific-bucket-only",
			"Effect": "Allow",
			"Principal": "*",
			"Action": "s3:GetObject",
			"Resource": [
				"arn:aws:s3:::aws-windows-downloads-us-east-1/*",
				"arn:aws:s3:::amazon-ssm-us-east-1/*",
				"arn:aws:s3:::amazon-ssm-packages-us-east-1/*",
				"arn:aws:s3:::us-east-1-birdwatcher-prod/*",
				"arn:aws:s3:::aws-ssm-distributor-file-us-east-1/*",
				"arn:aws:s3:::aws-ssm-document-attachments-us-east-1/*",
				"arn:aws:s3:::patch-baseline-snapshot-us-east-1/*",
				"arn:aws:s3:::amazonlinux.*.amazonaws.com/*",
				"arn:aws:s3:::repo.*.amazonaws.com/*",
				"arn:aws:s3:::packages.*.amazonaws.com/*"
			]
		}
	]
}