I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running.

You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers.

In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own RADIUS server.

And the question of how to manage access keypairs still remains unanswered, as far as I can tell.

I don't know if this is going to supplant Azure AD as our SSO method of choice.