I would like to enable multi-factor authentication on my organization's AWS root account, however I'm unsure of the best practices on how to do so.

We already have separate IAM accounts for each person needing access; most every account is extremely limited in permissions but several of us have full administrator access via IAM. Requiring MFA for each user's IAM account is easy since they can all setup Google Authenticated or Authy on their personal devices. However doing the same thing to the root account seems unwise, since it would limit access to a single person (which isn't very bus-proof). A couple ideas I've had are:

1. Enable MFA and have 2–3 admins scan the QR code (for the root account) at the same time.
2. Create a shared Authy account containing for this purpose and record the password somewhere secure that an admin can access it if needed.

Is there a best practice for doing this or another option I'm missing?

I would like to enable multi-factor authentication on my organization's AWS root account, however I'm unsure of the best practices on how to do so.

We already have separate IAM accounts for each person needing access; most every account is extremely limited in permissions but several of us have full administrator access via IAM. Requiring MFA for each user's IAM account is easy since they can all setup Google Authenticator or Authy on their personal devices. However doing the same thing to the root account seems unwise, since it would limit access to a single person (which isn't very bus-proof). A couple ideas I've had are:

1. Enable MFA and have 2–3 admins scan the QR code (for the root account) at the same time.
2. Create a shared Authy account containing for this purpose and record the password somewhere secure that an admin can access it if needed.

Is there a best practice for doing this or another option I'm missing?