Finally!

If you created a presigned URL by using a temporary token, then the URL expires when the token expires, even if you created the URL with a later expiration time. For more information about how the credentials you use affect the expiration time, see Who can create a presigned URL.

So you have to use regular IAM user instead of IAM role for service generating presigned urls..? :-/