{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::${account_id}:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "BoolIfExists": { "aws:MultiFactorAuthPresent": true },
        "NumericLessThan": { "aws:MultiFactorAuthAge": "3600" }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::${account_id}:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "BoolIfExists": { "aws:MultiFactorAuthPresent": true },
        "NumericLessThan": { "aws:MultiFactorAuthAge": "28800" }
      }
    }
  ]
}

Update MultiFactorAuthAge to 8 hours
Update MultiFactorAuthAge to 8 hours

One hour is just annoying enough to bump this up for now.
