getSignedUrl works for uploading (PUT), but returns a url I can't visit when I try to GET

[ssw1ss]

I have a bucket that has all public access blocked, and my policy (copied from a tutorial as I'm new to AWS and not super familiar with this stuff) that looks like this (some values edited for potential security concerns):

{
    "Version": "2012-10-17",
    "Id": "MyPolicyNumber", // edited
    "Statement": [
        {
            "Sid": "StmtNumber", // edited
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity" // edited
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::my-project/*" // edited
        }
    ]
}

I have a next.js site that has api routes which allow me to upload files from the server in one route, and retrieve the files in another route. The code to upload works successfully and looks like this:

const client = new S3Client({
  region: REGION,
});
const { fileName } = JSON.parse(req.body);
const command = new PutObjectCommand({
  Bucket: S3_BUCKET,
  Key: fileName,
});
const url = await getSignedUrl(client, command, { expiresIn: 3600 });
res.json({ url });

Then in the frontend, the url returned above can be called with a PUT fetch request and I can upload the file.

However, when I try to create a presigned url that allows a user to view the file, I get an issue I'm not sure how to resolve. A url is being generated without error, but it doesn't work. This is what that code looks like:

const signedUrl = await getSignedUrl(client, command, { expiresIn: 3600 });
console.log("SIGNED URL: ", signedUrl);

Am I missing something? My credentials are set properly and I can tell they work because the upload works, but not the downloading.