Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 385 discussion

D Explicit deny policies in IAM take precedence over any allow policies. If the IAM role attached to the EC2 instance explicitly denies access to S3, this deny will apply regardless of any other credentials or policies that might grant access. Even though the EC2 instance's credentials file specifies keys with full administrative access, the explicit deny in the IAM role will override these permissions for S3 actions.

Explicit deny policies in IAM take precedence over any allow policies

By default the AWS CLI uses environment variables then credentials file. Then if neither are present and an EC2 instance profile is attached, then this would be used. So with full access allowed by the key and secret in the local credentials file, full access to S3 would be allowed. Give it a try if you don't believe.

The credentials file containing IAM user credentials with full administrative permissions overrides the IAM role's permissions for S3 actions, allowing full access to S3.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html