Solved.
The rules work only when Worker goes to origin (S3 in my case). If the origin returns 403, I use Worker’s cache