I have an S3 bucket with the following CORS config.
With your curl -iI option you will be doing a HEAD request and not a GET request. So you will not get the CORS headers. To simplify testing add <AllowedMethod>HEAD</AllowedMethod> to your CORS configuration and you'll get the expected results.
<AllowedMethod>HEAD</AllowedMethod>