AWS CORS config, error 403 forbidden on file upload

I went through several troubleshooting guides, but can't seem to find a solution yet. I am uploading image files to my S3 bucket through a test website on http://localhost:3000.

If I set Write Objects to Allow on Public Access on the bucket the files are uploaded OK. However if I remove the checkboxes from the public access, and leave my CORS like this:

<CORSRule>
    <AllowedOrigin>http://localhost:3000</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <MaxAgeSeconds>3000</MaxAgeSeconds>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

the file won't upload and I will get an error:

POST https://s3-us-west-2.amazonaws.com/uploads 403 (Forbidden)

Any help appreciated.

Update:

headers: