Currently I am making an infrastructure with Cloudfront infront of S3 for serving public static assets.
The customer requested that they don’t like to have their public static assets being public on S3. They asked to put those assets inside VPN somehow with VPC endpoint

I don’t really seems to understand the proposal form customer

Cloudfront is strictly public

S3 is outside of VPN

VPC Endpoint is to help services inside VPC access S3 without the connection surfacing to the internet

Only way I can think of is Cloudfront -> ALB -> VPC Endpoint -> S3 that could leverage VPC Endpoint somehow but that still seems weird to me and not provide any additional security or control