In my specific case, AmazonS3 was handling photos without CORS issues. But they popped up on videos because browsers handle them different. I had to manually set CORS permissions in the Amazon S3 console and this issue was solved.

Since this is a security related issue, and it's recommended solution changes over time due to security concerns, I am not posting what settings I personally used. And you will need to make your own security assessment. But the settings are very easy to pull from a Google search, and then your security change is on you.

Also, not posting my security settings since I have only had them in the wild for hours. So I cannot speak to their worthiness in the wild.

But point is, CORS needs to be set server side for S3 for videos, but not photos.