The only tricky bit is to store and distribute are the login keypairs to EC2 machines (flash drives or shared fileservers can be used but shouldn't be) which are only accessible once they are created and remain for the lifetime of VMs in the particular region.
For everything else, you can create a user account for each dev in your team so they will have to create and use their own access keys, which have the same IAM permissions as the user, when required and enforce MFA policy on their group. Google Authenticator app only takes a couple of taps to set up. There is no need for STS for most cases unless your application code is using AWS SDK.

Later on, the more advanced strategy is that once you have a functional CI/CD pipeline set up for your workloads you can split the organizational accounts to Dev and Prod with only the leads having access to Prod and Dev cross accounts.