diff --git a/be/src/cloud/config.cpp b/be/src/cloud/config.cpp
index 8d30113e0cf519..5f7c94428a5e75 100644
--- a/be/src/cloud/config.cpp
+++ b/be/src/cloud/config.cpp
@@ -65,6 +65,8 @@ DEFINE_mInt32(mow_stream_load_commit_retry_times, "5");
 
 DEFINE_mBool(save_load_error_log_to_s3, "false");
 
+DEFINE_mBool(use_public_endpoint_for_error_log, "true");
+
 DEFINE_mInt32(sync_load_for_tablets_thread, "32");
 
 DEFINE_mBool(enable_new_tablet_do_compaction, "true");
diff --git a/be/src/cloud/config.h b/be/src/cloud/config.h
index 38092b34ff4244..3542808992b855 100644
--- a/be/src/cloud/config.h
+++ b/be/src/cloud/config.h
@@ -107,6 +107,9 @@ DECLARE_mInt32(mow_stream_load_commit_retry_times);
 
 DECLARE_mBool(save_load_error_log_to_s3);
 
+// Whether to use public endpoint for error log presigned URL
+DECLARE_mBool(use_public_endpoint_for_error_log);
+
 // the theads which sync the datas which loaded in other clusters
 DECLARE_mInt32(sync_load_for_tablets_thread);
 
diff --git a/be/src/runtime/runtime_state.cpp b/be/src/runtime/runtime_state.cpp
index 2beeed23c05e44..a99b9458972092 100644
--- a/be/src/runtime/runtime_state.cpp
+++ b/be/src/runtime/runtime_state.cpp
@@ -424,9 +424,10 @@ std::string RuntimeState::get_error_log_file_path() {
         }
         // expiration must be less than a week (in seconds) for presigned url
         static const unsigned EXPIRATION_SECONDS = 7 * 24 * 60 * 60 - 1;
-        // We should return a public endpoint to user.
-        _error_log_file_path = _s3_error_fs->generate_presigned_url(_s3_error_log_file_path,
-                                                                    EXPIRATION_SECONDS, true);
+        // Use public or private endpoint based on configuration
+        _error_log_file_path =
+                _s3_error_fs->generate_presigned_url(_s3_error_log_file_path, EXPIRATION_SECONDS,
+                                                     config::use_public_endpoint_for_error_log);
     }
     return _error_log_file_path;
 }