If memory serves me correctly, the purpose of the presigned URL is to allow access without worrying about the EC2 role. Did you try using the url in a normal browser window to see if the file is accessible that way?
What is the base operating system of the marketplace image? If it is some linux os, should be able to do curl __URL__ from inside the EC2 instance and make sure that can reach it.
Finally, double check that the url it tries to reach matches what you expect (i.e. correct https://.... with all the right slashes) (it should show up in the log I think when it says cannot connect to external resource)?
Sounds like its a network issue somewhere along the line....