If AWS_PROFILE is set, but a set of temporary STS credentials is in use from the environment, you must unset AWS_PROFILE or it will go for the static profile credentials, which will fail if 2FA is required.
Quick Reference
serverless deploy - deploy a Serverless package to AWS
serverless deploy function -f myFunction - only deploy function changes
serverless invoke --function hello - invoke a Lambda at AWS
serverless invoke local --function hello - invoke Lambda locally
serverless deploy list functions - list deployed functions