By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user wants to enable.
To me, such conservative defaults and fine-grained settings suggest that there is some reason that I might not want to let all of my buckets respond with
Access-Control-Allow-Origin: *, but for the life of me I can't think of a single way it could be abused.
S3 already provides a fairly elaborate ACL policy, and users cannot authenticate via cookies (as far as I know), so the problem doesn't seem to be people getting to information they shouldn't be able to get to.
S3 also provides an entirely separate way to block access to certain domains entirely, including for plain old image tags, so it doesn't seem to be an issue of hotlinking.
Is there any risk at all to a super-open CORS policy?