Agreed. One strategy that I have been using quite successfully is to: * create a new AWS account * setup IAM and AWS Org * add 2nd factor on the root account

Agreed. One strategy that I have been using quite successfully is to: * create a new AWS account * setup IAM and AWS Org * add 2nd factor on the root account, put the Gemalto in a safe Then add the "legacy" account to the org and slowly port all the resources to fresh new accounts.