How to fix Access Denied / 503 from AWS lambda in serverless-next.js deployment

I am deploying a Next.js app using serverless component (serverless-next.js, not the plugin). After deploying, my API routes run smoothly, but some (not all) pages and all content in /public folder are not accessible.

On the web, requests to those resources end with a 503:

content-length: 1019
content-type: text/html
date: Tue, 27 Oct 2020 19:55:05 GMT
server: CloudFront
status: 503
via: 1.1 79ba346413d83ce62db11c8d0b05c22d.cloudfront.net (CloudFront)
x-amz-cf-id: RalFtcB6W4pm1_eTgzr0Y9LWCR-uwfqgW2alSgX_X72YVlUxlEkrKw==
x-amz-cf-pop: PRG50-C1
x-cache: LambdaExecutionError from cloudfront

I tracked down the error to Default Lambda@Edge for Next CloudFront distribution where I can see a record for every call in CloudWatch logs:

{
    "errorType": "AccessDenied",
    "errorMessage": "Access Denied",
    "Code": "AccessDenied",
    "RequestId": "75B8CCC0B1F960A7",
    "HostId": "92cygvWjn3xLwT0PChJPc56ExzUFBDFTHyjLXQ/BWbT7pCVMb3I2ww15+Gzs2fSuXjHEPSfUIdg=",
    "name": "AccessDenied",
    "$fault": "client",
    "$metadata": {
        "httpStatusCode": 403,
        "httpHeaders": {
            "x-amz-request-id": "75B8CCC0B1F960A7",
            "x-amz-id-2": "92cygvWjn3xLwT0PChJPc56ExzUFBDFTHyjLXQ/BWbT7pCVMb3I2ww15+Gzs2fSuXjHEPSfUIdg=",
            "content-type": "application/xml",
            "transfer-encoding": "chunked",
            "date": "Tue, 27 Oct 2020 19:54:59 GMT",
            "server": "AmazonS3"
        },
        "attempts": 1,
        "totalRetryDelay": 0
    },
    "stack": [
        "AccessDenied: Access Denied",
        "    at deserializeAws_restXmlGetObjectCommandError (/var/task/index.js:14166:41)",
        "    at processTicksAndRejections (internal/process/task_queues.js:97:5)"
    ]
}

I checked the origin S3 bucket and all resources are there. I tried to remove complete deployment and do a clean deploy to no avail. As I understand the problem lies in S3 permissions, I granted the policy under which the lambda is invoked full access to S3 but the problem persists.

Any help how to debug this further appreciated.