There's AssumeRoleWithSAML so you can use any IdP There's tools like aws-okta that can advantage of that to supply short lived credentials which require 2FA Y

There's AssumeRoleWithSAML so you can use any IdP There's tools like aws-okta that can advantage of that to supply short lived credentials which require 2FA You could also write a service that requires whatever authentication you want and returns the results of STS AssumeRole