Access denied from static S3 website after successful login

following up from https://github.com/aws-samples/cloudfront-authorization-at-edge/issues/51

I have encountered a similar issue:

I have the same issue when deploying with following config:

```
resource "aws_serverlessapplicationrepository_cloudformation_stack" "cloudfront_authorization_at_edge" {
name = "CloudFrontAuthorizationAtEdge"
application_id = "arn:aws:serverlessrepo:us-east-1:520945424137:applications/cloudfront-authorization-at-edge"
semantic_version = "2.3.0"
capabilities = [
"CAPABILITY_IAM",
"CAPABILITY_RESOURCE_POLICY",
]

parameters = {
# Uncomment and modify the parameters as needed
# AdditionalCookies: "{}"
AlternateDomainNames : "private.mydomain.com"
# CloudFrontAccessLogsBucket: ""
# CookieCompatibility: "amplify"
# CookieSettings: "{\"idToken\": null,\"accessToken\": null,\"refreshToken\": null,\"nonce\": null}"
# CreateCloudFrontDistribution : "true"
# CustomOriginDomainName: ""
# CustomOriginHeaderName: ""
# CustomOriginHeaderValue: ""
DefaultRootObject : ""
EmailAddress : "email@gmail.com"
EnableSPAMode : "false"
# HttpHeaders: "{\"Content-Security-Policy\": \"default-src 'none'; img-src 'self'; script-src 'self' https://code.jquery.com https://stackpath.bootstrapcdn.com; style-src 'self' 'unsafe-inline' https://stackpath.bootstrapcdn.com; object-src 'none'; connect-src 'self' https://*.amazonaws.com https://*.amazoncognito.com\",\"Strict-Transport-Security\": \"max-age=31536000; includeSubdomains; preload\",\"Referrer-Policy\": \"same-origin\",\"X-XSS-Protection\": \"1; mode=block\",\"X-Frame-Options\": \"DENY\",\"X-Content-Type-Options\": \"nosniff\"}"
# LogLevel: "none"
OAuthScopes : "phone,email,profile,openid,aws.cognito.signin.user.admin"
OriginAccessIdentity : "${aws_cloudfront_origin_access_identity.oai.id}"
# PermissionsBoundaryPolicyArn: ""
# RedirectPathAuthRefresh: "/refreshauth"
# RedirectPathSignIn: "/parseauth"
# RedirectPathSignOut: "/"
# ResourceSuffix: ""
# RewritePathWithTrailingSlashToIndex: "false"
S3OriginDomainName : "something.s3.us-east-2.amazonaws.com"
# SignOutUrl: "/signout"
# UserPoolArn : ""
# UserPoolAuthDomain : ""
# UserPoolClientId : ""
# UserPoolClientSecret: ""
# UserPoolGroupName: ""
# Version: "2.3.0"
# WebACLId: ""
}
}

```
when navigating to the CloudFront Distribution URL I get:

```
This XML file does not appear to have any style information associated with it. The document tree is shown below. AccessDenied Access Denied E5Q5TY2V8N7SFAHW xM7ISQL6LsSlrwZ5IKBKsUxR+LEZMdpINQM2ZTBU5J1owOcPSSe0o84yj1cx9MYVkE21xOzr19HhCFJi2OuFjw==
```

When investigating the ParseAuth or HttpHeadersHandler, etc Lambda I see in the console:

There was an error while making a request to StartQuery Log group '/aws/lambda/serverlessrepo-CloudFrontAuthoriz-ParseAuthHandler-UUKhV0aiSBqS' does not exist for account ID '547...' (Service: AWSLogs; Status Code: 400; Error Code: ResourceNotFoundException; Request ID: 292cb6cb-488f-4d20-a52f-ec09315a9953; Proxy: null)

Start by comparing this report with the linked issue 51 and the supplied Terraform configuration, especially the S3OriginDomainName and authentication parameters. Then inspect the ParseAuth and HttpHeadersHandler Lambda entries and the reported CloudWatch log group error. Done means identifying the cause of the post-login AccessDenied response and documenting or verifying a reproducible resolution.

Written by the indexing model from the issue text.