Restricting access only to specific EFS folders per IAM user.

Hello everyone, The scenario: I have an EFS that contains various folders and subfolders. I also have multiple Linux users (more than 50) for which I have also IAM users defined with some non-relative policies for S3 and other services.

My problem: I want to give permissions to specific users to be able to access (read/write/execute) on specific subfolders in the EFS.

Non-working solutions: One possible way (the typical one) would have been to set groups, assign users to the groups and then give the corresponding access to the subfolders I want, to these specific groups. However, for NFS access, Linux users by default cant be members to more than 16 groups. Otherwise groups are not recognized properly on NFS. My scenario would require, possibly, a user to be able to access more than 20 subfolders which would require him to be member in 20+ groups. This makes the group solution as not an option.

Maybe another solution would have been to set resource-based policies on the EFS, but the resource-based policies are up to 20K characters. So this is not an option for me neither, since i have more than 50 users, and defining that resource-based policy would require much more characters. Also, I am pretty sure that with Resource based policy I cant grant access to specific subfolders while denying to others.

My obvious question: How can i do this? How can specific users access specific subfolders of an EFS? Thank you so much.