From 9984f19f9705fd5e1738d1aa4f404d8472bbb428 Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Mon, 17 Nov 2025 00:12:26 +0800
Subject: [PATCH] refactor(iam): convert IAM module to reusable universal role
 module

---
 .../terraform-standard/envs/dev/main.tf       | 23 +++++++++---
 .../terraform-standard/envs/dev/provider.tf   |  2 +-
 .../terraform-standard/modules/iam/main.tf    | 21 +++++------
 .../terraform-standard/modules/iam/outputs.tf |  6 +++-
 .../modules/iam/provider.tf                   | 25 -------------
 .../modules/iam/variables.tf                  | 36 ++++++++++---------
 6 files changed, 53 insertions(+), 60 deletions(-)
 delete mode 100644 iac-template/terraform-standard/modules/iam/provider.tf

diff --git a/iac-template/terraform-standard/envs/dev/main.tf b/iac-template/terraform-standard/envs/dev/main.tf
index 11371a9f..df15c4e2 100644
--- a/iac-template/terraform-standard/envs/dev/main.tf
+++ b/iac-template/terraform-standard/envs/dev/main.tf
@@ -4,8 +4,23 @@ locals {
   )
 }
 
-# 第一个正式 module：iam
-module "iam" {
-  source  = "../../modules/iam"
-  account = local.account   # << 唯一需要传入 module 的变量
+
+data "aws_iam_policy_document" "dev_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${local.account.account_id}:root"]
+    }
+  }
+}
+
+module "dev_role" {
+  source = "../../modules/iam"
+
+  name               = "dev-app-role"
+  assume_role_policy = data.aws_iam_policy_document.dev_assume.json
+
+  tags = local.account.tags
 }
diff --git a/iac-template/terraform-standard/envs/dev/provider.tf b/iac-template/terraform-standard/envs/dev/provider.tf
index 212806de..7bddf948 100644
--- a/iac-template/terraform-standard/envs/dev/provider.tf
+++ b/iac-template/terraform-standard/envs/dev/provider.tf
@@ -10,7 +10,7 @@ terraform {
 }
 
 provider "aws" {
-  region = "ap-northeast-1"
+  region = local.account.region
 
   assume_role {
     role_arn     = "arn:aws:iam::730335654753:role/TerraformDeployRole-Dev"
diff --git a/iac-template/terraform-standard/modules/iam/main.tf b/iac-template/terraform-standard/modules/iam/main.tf
index 3d80c910..6ade1bc1 100644
--- a/iac-template/terraform-standard/modules/iam/main.tf
+++ b/iac-template/terraform-standard/modules/iam/main.tf
@@ -1,18 +1,13 @@
 resource "aws_iam_role" "this" {
-  name = var.role_name
-
-  assume_role_policy = data.aws_iam_policy_document.assume.json
-
-  tags = var.tags
+  name               = var.name
+  assume_role_policy = var.assume_role_policy
+  tags               = var.tags
 }
 
-data "aws_iam_policy_document" "assume" {
-  statement {
-    actions = ["sts:AssumeRole"]
+# 附加多个 AWS managed policies
+resource "aws_iam_role_policy_attachment" "managed" {
+  for_each = toset(var.managed_policy_arns)
 
-    principals {
-      type        = "AWS"
-      identifiers = ["*"] # 你可以未来改为 OIDC provider 等
-    }
-  }
+  role       = aws_iam_role.this.name
+  policy_arn = each.value
 }
diff --git a/iac-template/terraform-standard/modules/iam/outputs.tf b/iac-template/terraform-standard/modules/iam/outputs.tf
index e01d61bc..aee3bafb 100644
--- a/iac-template/terraform-standard/modules/iam/outputs.tf
+++ b/iac-template/terraform-standard/modules/iam/outputs.tf
@@ -1,3 +1,7 @@
-output "role_arn" {
+output "arn" {
   value = aws_iam_role.this.arn
 }
+
+output "name" {
+  value = aws_iam_role.this.name
+}
diff --git a/iac-template/terraform-standard/modules/iam/provider.tf b/iac-template/terraform-standard/modules/iam/provider.tf
deleted file mode 100644
index 300cbef7..00000000
--- a/iac-template/terraform-standard/modules/iam/provider.tf
+++ /dev/null
@@ -1,25 +0,0 @@
-locals {
-  account = yamldecode(
-    file("${path.root}/../../config/accounts/dev.yaml")
-  )
-}
-
-terraform {
-  required_version = ">= 1.2"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 5.92.0"
-    }
-  }
-}
-
-provider "aws" {
-  region = var.region
-
-  assume_role {
-    role_arn     = "local.account.role_to_assume"
-    session_name = "TerraformDevSession"
-  }
-}
diff --git a/iac-template/terraform-standard/modules/iam/variables.tf b/iac-template/terraform-standard/modules/iam/variables.tf
index f90d91e4..ae611d04 100644
--- a/iac-template/terraform-standard/modules/iam/variables.tf
+++ b/iac-template/terraform-standard/modules/iam/variables.tf
@@ -1,18 +1,22 @@
-variable "account" {
-  type = object({
-    account_id       = string
-    name             = string
-    environment      = string
-    region           = string
-    role_to_assume   = string
-    logging_bucket   = string
-    shared_vpc_account = string
-    backend = object({
-      bucket         = string
-      key_prefix     = string
-      dynamodb_table = string
-    })
-    tags = map(string)
-  })
+variable "name" {
+  description = "IAM role name"
+  type        = string
+}
+
+variable "assume_role_policy" {
+  description = "Assume role policy JSON"
+  type        = string
+}
+
+variable "managed_policy_arns" {
+  description = "List of managed policy ARNs to attach"
+  type        = list(string)
+  default     = []
+}
+
+variable "tags" {
+  description = "Tags to apply to the IAM role"
+  type        = map(string)
+  default     = {}
 }