EFS Limits in and EKS environment (total number of volumes/access points/mount points)

Access Points per File System Limit: You're correct, the AWS Documentation is the authoritative source for the latest limits. The 1000 access points per file system limit mentioned in the documentation is the correct and up-to-date value.

User Limit based on Access Points: Yes, assuming one access point (and root directory) per user, the limit of 1000 access points per file system would translate to a maximum of 1000 users per file system. However, you can create up to 1000 file systems per AWS account, which would allow you to have up to 1,000,000 users (1000 access points x 1000 file systems) in a single AWS account.

Mount Points and EKS Node Limit: The 1400 mount points limit applies to the total number of mount points that can be created across all file systems in an AWS account. This limit is not directly related to the number of EKS nodes. The number of EKS nodes you can have depends on the instance types and the available resources (CPU, memory, etc.) in your cluster.

File System Level Quota for Access Points: Amazon EFS does not currently provide a built-in way to apply file system-level quotas for individual access points. However, you can achieve this by using a combination of EFS access points and EFS lifecycle management policies.

Here's a high-level approach you can consider:

Create a separate file system for each user or group of users. Create an access point for each user or group within their respective file system. Configure EFS lifecycle management policies to automatically move files that haven't been accessed for a certain period (e.g., 30 days) to the Infrequent Access (IA) storage class, which is cheaper but has higher latency. Set a maximum size limit for the file system using the lifecycle management policy, which will effectively limit the storage available to each user or group. While this approach requires more file systems and access points, it provides a way to manage storage quotas and costs at a granular level without relying on IAM policies.