The way it works best is when you have multiple accounts ,you have a single Identity account, which is where your user accounts live. This account basically all

The way it works best is when you have multiple accounts ,you have a single Identity account, which is where your user accounts live. This account basically allows sign in and assume role - oh and you can't assume unless you have authenticated with MFA. Then, all your other accounts - dev, prod, service, whatever - simply have roles and no user management overhead - i.e you aren't duplicating users in a bunch of accounts and having to deal with a bunch of different identities.