Cross-regional S3 access from Lambda

Hello.

Since VPC endpoints can only access S3 in the same region, I think you will need to create a NAT Gateway etc. to be able to access S3.
Additionally, as introduced in the document below, it is also possible to perform VPC peering with a VPC in another region and route it through the interface VPC endpoint.
https://repost.aws/knowledge-center/vpc-endpoints-cross-region-aws-services

Or you should be able to access it by setting up a multi-region access point like you have set up.
When using Multi-Region Access Points, you need to either configure private DNS or specify in your Lambda code to access "accesspoint.vpce-.accesspoint.s3-global.us-east-1.vpce.amazonaws.com" as the VPC endpoint.
Also, since a timeout error is occurring, please check whether HTTPS is allowed in the inbound rules of the VPC endpoint's security group.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointsPrivateLink.html

If private DNS is not enabled on the VPC endpoint, you can access it by setting "endpoint_url" as shown below.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#accessing-bucket-and-aps-from-interface-endpoints

client = boto3.client('s3', endpoint_url='https://accesspoint.vpce-1a2b3c4d-5e6f.s3.us-east-1.vpce.amazonaws.com')

S3 supports IPv6 on its public endpoints, so instead of setting up a NAT gateway and paying both hourly and traffic-based fees for it, or setting up VPC interface endpoints that also involve both hourly and per-gigabyte fees, you could add IPv6 addresses to your VPC and the subnets used by the Lambda function to make it a dual-stack VPC, attach an egress-only internet gateway to it, and route the IPv6 default route ::0/0 towards the new egress-only IGW. Also permit outbound IPv6 traffic to ::0/0 on the TCP port 443 in the Lambda function's security group.

You can use access policies to prevent the Lambda execution role from accessing S3 unless the request arrives either through the VPC endpoint in the local region or the IPv6 CIDR for cross-region requests.

You'll still have to pay cross-region traffic fees, but this setup would avoid hourly and per-gigabyte fees for the NAT gateways, because egress-only IGWs are free, the same as regular IGWs, and you could still restrict access based on network origin by using the aws:SourceVpc or aws:SourceVpce condition keys for S3 access within the region and aws:SourceIp for cross-region S3 access.

You can attach a policy statement like this one to the Lambda function's execution role to prevent it from accessing any AWS resource from outside the IPv6 CIDR of the VPC or any of the VPC endpoints in the VPC. Replace vpc-00000000000000000 with your VPC ID and fd6f:59a7:101c::/56 (a dummy address) with the IPv6 CIDR:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAllAccessExceptFromPermittedNetworkOrigins",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:SourceVpc": ["vpc-00000000000000000"]
        },
        "NotIpAddressIfExists": {
          "aws:SourceIp": ["fd6f:59a7:101c::/56"]
        },
        "BoolIfExists": {
          "aws:ViaAWSService": "false"
        }
      }
    }
  ]
}