I have an S3 bucket with the following CORS config.
With your curl -iI option you will be doing a HEAD request and not a GET request. So you will not get the CORS headers. To simplify testing add HEAD to your CORS configuration and you'll get the expected results.
HEAD