Hi Alistair,
Yes, Amazon S3 now supports CORS and we've tested it to be working with WebViewer.
This is the CORS configuration we use for our buckets:
<?xml version="1.0" encoding="UTF-8"?>
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>