Per the AWS blog U2F is now supported for Console login:
https://aws.amazon.com/blogs/security/use-yubikey-security-key-sign-into-aws-management-console/

It is especially critical there be a path to support this on the aws-cli so we can tap to perform commands instead of having long lived tokens on disk/memory.