Looks like spaces don’t implement the AWS S3 API for the CORS rule. That is a must have since assets can contain fonts, and those really need CORS.
Maybe work on a way to disable the rules insertion and took care of that manually?
@rishabh did this already with the tombstone rule to allow our S3 compatibility with more providers, so makes sense to expand on that.