I just got off a support chat with AWS, and they seemed to imply that a user could log into the AWS Console using an IAM role (not an IAM user). I don’t see how that’s possible though. anyone know?

A previous product I built allowed users to do this via https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

When you log in with AWS SSO you're logging in with a role (an AWS SSO managed role)