Ensure IAM user, group, or role should have MFA permissions restricted

IAM users,groups and roles must explicitly be given permissions to deactivate and reset multi-factor authentication (MFA) for other IAM resources. You can do this by attaching an identity-based policy to the resources.