Best practices to manage access to FedRAMP Moderate accounts in commercial US East/West regions without IAM Identity Center?

Based on the information available, I can provide some guidance on your questions regarding FedRAMP Moderate compliance and the use of IAM Identity Center (formerly AWS SSO) in AWS commercial regions.

1. While IAM Identity Center is not explicitly listed as in-scope for FedRAMP Moderate in the US East/West commercial regions, it may still be possible to use it for SSO in your overall AWS environment. However, you would need to carefully segregate your FedRAMP Moderate workloads into separate accounts that do not rely on Identity Center for access. This approach would require you to implement alternative access methods for those specific FedRAMP Moderate accounts.

2. For the accounts that are in-scope for your FedRAMP Moderate workloads, you are correct in identifying the following options for human access:

   a. Per-account IAM users b. SAML Federation in IAM using a compliant in-house or 3rd-party Identity Provider (IdP) c. Cross-account IAM roles

These methods are generally accepted for FedRAMP Moderate environments. However, it's important to note that using per-account IAM users can be more challenging to manage and may introduce additional security risks if not properly maintained.

Another option you might consider is using AWS Organizations with Service Control Policies (SCPs) to enforce access controls and compliance requirements across your accounts, including those housing FedRAMP Moderate workloads.

It's worth noting that while IAM Identity Center isn't explicitly listed for FedRAMP Moderate in commercial regions, AWS continually works on expanding its compliance offerings. It may be beneficial to consult directly with AWS or a FedRAMP advisor to get the most up-to-date information on using Identity Center in a FedRAMP Moderate environment.

To minimize future pain points, consider the following advice:

1. Design your account structure with clear separation between FedRAMP Moderate workloads and non-FedRAMP workloads.
2. Implement strong access controls and monitoring for all accounts, regardless of their FedRAMP status.
3. Use AWS Config and AWS CloudTrail to maintain an audit trail of all actions and changes in your environment.
4. Regularly review and update your access management strategy to align with the latest FedRAMP guidelines and AWS service offerings.
5. Consider implementing a compliant third-party IdP solution that can work with both IAM Identity Center and direct IAM federation, providing flexibility as compliance requirements evolve.

Remember that FedRAMP is indeed a baseline, and specific agency requirements may vary. Always consult with your agency's security team and potentially a FedRAMP advisor to ensure your chosen approach meets all necessary compliance requirements.
Sources
AWS FedRAMP Revision 5 baselines transition update | AWS Security Blog
Operational Best Practices for FedRAMP(Moderate) - AWS Config
6 Steps Towards Achieving FedRAMP Authorization on AWS with Orca Security | AWS Partner Network (APN) Blog
Using AWS Marketplace to extend FedRamp compliant architectures | AWS Marketplace