Yes you read that correctly, you can assign MFA to your IAM users. You have a few options for this. You can use a virtual MFA device, such as Microsoft authenticator. You can have multiple accounts assigned to this so you don’t need to have a device for every account you own, that would get expensive. Your other option is a Universal 2nd Factor (U2F) authenticator, a physical device which is very similar to the authenticator app as you can have multiple accounts assigned to it however it is a physical hardware device.