For non root user, iam:GetUser is no necessary, iam:ListMFADevices is enough

[ikuwow]

awsmfa/awsmfa/__main__.py

Lines 331 to 345 in bbd9ef8

	user = iam.get_user()
	if user['User']['Arn'].endswith(':root'):
	# The root user MFA device is not in the same way as non-root
	# users, so we must find the root MFA devices using a different
	# method than we do for normal users.
	devices = boto3_session.resource('iam').CurrentUser().mfa_devices.all()
	serials = (x.serial_number for x in devices)
	else:
	# Non-root users can have a restrictive policy that allows them
	# only to list devices associated with their user but it requires
	# using the low level IAM client to compose the proper request.
	username = user['User']['UserName']
	devices = botocore_session.create_client('iam').list_mfa_devices(
	UserName=username)
	serials = (x['SerialNumber'] for x in devices['MFADevices'])

https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListMFADevices.html

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID signing the request for this API.