It actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple

It actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple MFA devices unlike IAM. It's a giant hack but works!