ACC - Upload a File - Get signed S3 URL - 403 Forbidden

I am trying to upload a file on Autodesk Construction Cloud. I have Account Admin rights and all permissions for folder managament in project. I followed steps from official Autodesk site: https://aps.autodesk.com/en/docs/acc/v1/tutorials/files/upload-document-s3/ I got stuck on Step 6 - response 403

public static string GetSignedS3Url(string fileId, string fileLocalPath)
    {
        // Extract the bucket key and object key from the fileId
        // fileId example: "urn:adsk.objects:os.object:wip.dm.prod/65d31f56-99ce-4e72-be80-9dc94066d24a.ifc"
        // fileLocationPath = Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + "\\MyFile.ifc
        var parts = fileId.Split('/');
        if (parts.Length < 2) return null;
    
        string bucketKey = parts[0].Split(':')[1]; // "wip.dm.prod"
        string objectKey = parts[1]; // "65d31f99-99ce-4e72-be80-9dc94066d24a.ifc"
    
        // Define the URL for getting the signed S3 upload URL
        string url = $"https://developer.api.autodesk.com/oss/v2/buckets/{bucketKey}/objects/{objectKey}/signeds3upload";
    
        // Use the access token from GetAccessToken method
        string accessToken = GetAccessToken("data:write data:create"); //tried also: "data:read data:write data:create bucket:read bucket:create" - same problem
    
        if (string.IsNullOrEmpty(accessToken))
        {
            Console.Display("Failed to get access token", Outcome.Failure);
            return null;
        }
    
        using (var client = new HttpClient())
        {
            client.DefaultRequestHeaders.Add("Authorization", $"Bearer {accessToken}");
    
            // Send the GET request to get the signed URL
            var response = client.GetAsync(url).Result;
            if (!response.IsSuccessStatusCode)
            {
                //403 Forbidden response is here    
                Console.WriteLine($"Response: {response}");
                Console.WriteLine($"Failed to get signed URL: {response.ReasonPhrase}");
                return null;
            }
         }
    }

Why permission here is the issue ?

the mistake was made in previous step - creation of storage object: https://aps.autodesk.com/en/docs/data/v2/reference/http/projects-project_id-storage-POST/
wrong scope for accessToken was provided. Was data:write, has to be data:create