Web app unable to access private s3 file even though IAM policy grants access

I am using CarrierWave direct to upload a high resolution images to s3. I then use that image to process multiple versions which are made public.

The uploaded high res files need to remain private to anonymous users, but the web application needs to access the private file in order to do the processing on for other versions.

I have tried writing bucket policies and IAM policies with no luck.

I am currently setting the all uploaded files to private via

config.fog_public = false

I have an IAM policy for the web app that allows full admin access. I also have set the ACCESSKEY AND SECRETKEY in the app. Given these two criteria, I would think that the web app could access the private file and continue with processing, but it is denied access to the private file.

*When I log into the user account associated with the web app, I am able to access the private file because a token is added on to the URL.

I can't figure out why the app cannot access the private file given the ACCESSKEY AND SECRRETKEY