It’s definitely something to do with avatar image handling. Have just tried again with the same image (using the iOS mobile client this time) and it uploads fine inside a post but gives same access denied error when using same image as avatar.
Can anyone else using s3 with secure media replicate the error? Could it be something to do with bucket permissions given the uploading for a post does work?