Thanks, Robitaille. Yes, it makes sense to deploy the service in the private subnet. For my architecture, I have also deployed in the private subnet.