I have the following CORS configuration for S3 in order to use one of my buckets as a static website hosting:
This isn't CORS related -- it's S3 itself. The S3 website endpoints are only equipped for GET and HEAD. Anything else should be denied before the redirection rules are checked.
Website Endpoint
Supports only GET and HEAD requests on objects.
— http://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteEndpoints.html