A Config rule that checks whether users of your AWS account require a multi-factor authentication (MFA) device to sign in with root credentials.

CloudFormation Template