I found the root cause. Due to my setup of the Discourse AI plugin I had added a private Zone to the VPC to make the diverse services available VPC internally.
When running Discourse on an EC2 instance in a Docker container, the container gets a host name like 12-34-56-78-app. When running as an ECS task however you can not set the host name when in awsvpc mode, neither you can’t configure the DNS search domain. This leads to the fact that DNS resolution is different on ECS, in my case adding a search domain like xxxx.internal.
After digging around I found using tcpdump that Discourse tries to resolve its own FQDN as part of the SSRF checks. If this fails, the check fail. As a subsequent error the call to S3 fails with the bogus error message above.
The fix in my case was to add the FQDN record which is an alias to my Cloudfront distribution to my private DNS zone.