first I configured key access on the instance (it was impossible to attach role after the launch then)
forgot about it for a few months
attached role to instance
tried to access.
The configured key had higher priority than role, and access was denied because the user wasn't granted with necessary S3 permissions.
Solution: rm -rf .aws/credentials, then aws uses role.