Add the ability to IAM to create a virtual mfa device