Earlier quoted context omitted.
While this is true, the spirit of the GP is correct. To login you will need both a username/password and the second factor. So losing the key is still relevant. In practice that means people really need to buy (at least) two yubikeys to register with services that allow it. Have one on something that’s always with you (such as keys) and the extra(s) as a backup somewhere secure. Unfortunately this works with most acc…
To sidestep this, create a new AWS account to be your master SSO administration account (separate from whatever account you're already using), and enable "AWS Organizations" in it. Join the existing AWS accounts to the new "AWS Organization". Once you enable AWS SSO for the "organization", you can then set up SAML SSO to your existing identity provider (e.g. G Suite, which allows multiple hardware 2FA tokens per user…
Re: Getting a biometric security key right
#81I’m going to have to take a look at this, this sounds awesome thank you!