If you haven't dealt with this before, it's not calling support and social-engineering someone into hitting the reset button. The last time I knew someone who had to reset an AWS root account password (broken Yubikey), it required multiple phone calls AWS initiated to the billing & technical contacts (which can only be set by root so an attacker can't easily change them) to confirm intention and then they had to sign a form in front of a notary who checked photo ID.
I classed that as more secure since you can't do it remotely and the in-person portion further increases the difficulty.
I classed that as more secure since you can't do it remotely and the in-person portion further increases the difficulty.