Sorry for the very late reply! You can use either. Using private is more difficult however - you need to have the ACM certificate so the private domain needs a correctly configured public parent, and the private zone can only be used inside the VPC or via DNS resolvers . Private DNS is more difficult to setup and test.