I have some problems accessing my S3 images via get request form my express server.

I have a mongo database where I store text information for the items on my webpage and save the image key that I send to my S3 bucket. Now when I try to get all the items and the respective png images, this error came to me:

...aws-sdk\lib\request.js:31
        throw err;
        ^
AccessDenied: Access Denied ...

even if my user authorization in S3 is good.

Because I need to fetch all the items for a productPage component I go like this:

//ROUTER FILE
router.get("/cust/test", async (req, res) => {
  try {
    let tests;
    tests = await Test.find();

    tests.map((t) => {
      const png = t.png;
      const readStream = s3DwnPng(png);

      readStream.pipe(res);
      console.log(png);
    });

    res.status(200).json(tests);
    console.log(tests);
  } catch (err) {
    res.status(500).json(err);
  }
});

//S3 FILE

function s3DwnPng(fileKey) {
  const dwnParams = {
    Bucket: process.env.AWS_BUCKET_NAME,
    Key: `png/${fileKey}`,
  };

  return s3.getObject(dwnParams).createReadStream();
}
exports.s3DwnPng = s3DwnPng;

but this does not work for me. Someone could help me?

And is it worth persisting accessing the images passing throw my server? I'm considering switching to a public policy with private CORS access to make the load on my server lighter, is it really secure to do so?