Everybody recommending Yubikey: because this [0], use that [1] instead. Amazon uses Gemalto [2] for AWS MFA, but I've had bad experience with it, and cannot recommend it.

[0]: https://plus.google.com/+KonstantinRyabitsev/posts/4a7RNxtt7...

[1]: https://www.nitrokey.com/

[2]: http://www.gemalto.com/