Can use a private IP address as the puppet certname?
You can indeed use IP address in the "certname" directive of puppet.conf file.

In addition, you can create a private hosted zone in AWS Route53 that is called for example lab.local and then create an A record for your puppet server such as for example puppetmaster.lab.local and then use this address in the certname directive.

Opening a hosted zone in Route 53 doesn't cost much... around 0.50$ per month for your first 25 zones.

The full Route53 pricing can be found here.