You can make it work by creating multiple IAM users, for different keys. Just make sure they have billing and full admin access. Still doesn't help for root 2fa, but just give that a random 32 char password and stick that in a safe deposit box or something.