Jenkins in private subnet
If you want to make it private either you need to setup a vpn so that you can access jenkins gui using http://private-subnet-ip:jenkins_port or you can move jenkins behind a load balancer and use load-balancer-dns to access jenkins gui. If it is in public subnet then use NACL/Security Groups to restrict access only to trusted sources. For more security, do not assign public ip to jenkins machine, assign dns hostname(even to load balancer you should do that) and implement ssl over http so that it can be accessed over https only.