Three users exist: dana, sam and a service account legacy-bot. Audit them:
sh
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 -d
aws iam list-access-keys --user-name legacy-bot
aws iam get-access-key-last-used --access-key-id AKIA…Retire what is not used, then attach the guardrail drafted in ~/deny-without-mfa.json to the staff group as a customer managed policy named DenyWithoutMFA.