This has been a concern for me for a while, but it's possible to use aws cli with mfa by throwing an IdP in front of it. The work flow we used was AWS Vault ->

This has been a concern for me for a while, but it's possible to use aws cli with mfa by throwing an IdP in front of it. The work flow we used was AWS Vault -> Okta -> short lived AWS creds.