Within our corporation, we have a dedicated team that manages our AWS footprint. For each dev/app team, we provision a new account with a VPC and some networking to attach it to our pan-galactic network mesh. However the root keys for that account owner are kept and managed by our AWS management team. The devs are allocated IAM accounts with superadmin privs so they can pretty much do whatever they want but we still maintain master control.
The problem is that with a team of people, you can't easily create the root account and attach MFA to it. Amazon has some suggestions that basically boil down to setting a complex lengthy password on the account then just lose the password.
Are there solutions that enable a group of individuals in a team to manage a common MFA so we can enable MFA on the root account?