aws cognito-idp set-user-pool-mfa-config --user-pool-id us-east-2_eeMGPsAAA --mfa-configuration ON --software-token-mfa-configuration Enabled=true

Or OPTIONAL

aws cognito-idp set-user-pool-mfa-config --user-pool-id us-east-2_eeMGPsAAA --mfa-configuration OPTIONAL --software-token-mfa-configuration Enabled=true