How can I realistically secure the AWS service account that Terraform uses?

Question

I'm looking for a way to secure the AWS service account, which is a Programmatic access user account which Terraform uses. I can think of utilizing a policy that abides by Principle of least privilege, which helps, but I am looking to take this further.

Would enabling MFA or SSO cause the service account to be inaccessible when running a Terraform Apply? I plan on having the service account credentials exist within Terraform Cloud as secrets.