The best choice is Build an Amazon API Gateway WebSocket API and integrate privately via VPC link to a load balancer that fronts the EKS workloads. This option delivers a managed WebSocket endpoint for persistent bidirectional connections while keeping the chat microservices private inside the VPC.

Build an Amazon API Gateway WebSocket API and integrate privately via VPC link to a load balancer that fronts the EKS workloads is correct because WebSocket APIs provide full duplex, long lived connections required for real time chat and API Gateway can reach private targets by using a VPC link that points to an internal Network Load Balancer. The internal load balancer fronts the EKS pods so traffic never traverses the public internet and the NLB scales and performs well for tens of thousands of concurrent connections.

Build an Amazon API Gateway REST API and use a private VPC link to reach the EKS service is unsuitable because REST does not provide persistent full duplex connections and would not meet the real time bidirectional requirement for chat.

Amazon AppSync can support GraphQL subscriptions that behave like WebSockets but it is a GraphQL managed service and does not directly implement the API Gateway WebSocket plus VPC link pattern to privately front EKS workloads, so it does not match the architecture asked for.

Build an Amazon API Gateway WebSocket API and allow access by adding security group rules that permit API Gateway to reach the EKS endpoints is not viable because API Gateway is a managed service external to your VPC and cannot be granted access solely by adding security group rules. A VPC link to an internal load balancer is required for private integrations.

Full AWS Practitioner Certification Question