EC2 instances - Allow all public IPs of a cloudfront distribution in the security group manuallY?

You cannot have ALBs in private subnet talk to cloudfront, it must have to be a public one, but atleast your EC2 instances can be public