From 9d28489abbeab2de7cb5efae81faca78d2e4719d Mon Sep 17 00:00:00 2001
From: "blinkagent[bot]" <237617714+blinkagent[bot]@users.noreply.github.com>
Date: Sat, 30 May 2026 13:05:51 +0500
Subject: [PATCH] chore(provisioner/terraform): preserve existing
 AWS_SDK_UA_APP_ID (#24606)

Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: Atif Ali <atif@coder.com>
---
 provisioner/terraform/provision.go            |  2 +-
 provisioner/terraform/safeenv.go              | 36 +++++++++++++++
 .../terraform/safeenv_internal_test.go        | 44 +++++++++++++++++++
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 provisioner/terraform/safeenv_internal_test.go

diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
index 592bc3c9cc..90c96403bc 100644
--- a/provisioner/terraform/provision.go
+++ b/provisioner/terraform/provision.go
@@ -381,7 +381,7 @@ func provisionEnv(
 		"CODER_WORKSPACE_BUILD_ID="+metadata.GetWorkspaceBuildId(),
 		"CODER_TASK_ID="+metadata.GetTaskId(),
 		"CODER_TASK_PROMPT="+metadata.GetTaskPrompt(),
-		"AWS_SDK_UA_APP_ID=APN_1.1/pc_cdfmjwn8i6u8l9fwz8h82e4w3$",
+		awsSDKUserAgentEnv(safeEnvironValue(env, awsSDKUserAgentEnvKey)),
 	)
 	if metadata.GetPrebuiltWorkspaceBuildStage().IsPrebuild() {
 		env = append(env, provider.IsPrebuildEnvironmentVariable()+"=true")
diff --git a/provisioner/terraform/safeenv.go b/provisioner/terraform/safeenv.go
index 4da2fc32cd..a42a899bc8 100644
--- a/provisioner/terraform/safeenv.go
+++ b/provisioner/terraform/safeenv.go
@@ -53,3 +53,39 @@ func safeEnviron() []string {
 	}
 	return strippedEnv
 }
+
+// safeEnvironValue returns the value of the named variable in the given
+// `KEY=VALUE` environment slice, or an empty string if it is not present.
+func safeEnvironValue(env []string, name string) string {
+	prefix := name + "="
+	for _, e := range env {
+		if strings.HasPrefix(e, prefix) {
+			return strings.TrimPrefix(e, prefix)
+		}
+	}
+	return ""
+}
+
+const (
+	awsSDKUserAgentEnvKey = "AWS_SDK_UA_APP_ID"
+	// awsSDKUserAgentCoder is Coder's AWS Partner Revenue Measurement
+	// User-Agent string. The `APN_1.1/pc_<product-code>$` format and the
+	// space-delimited append behavior below follow AWS's guidance:
+	// https://docs.aws.amazon.com/PRM/latest/aws-prm-onboarding-guide/automated-user-agent.html
+	awsSDKUserAgentCoder = "APN_1.1/pc_cdfmjwn8i6u8l9fwz8h82e4w3$"
+)
+
+// awsSDKUserAgentEnv returns the AWS_SDK_UA_APP_ID value to pass to the
+// Terraform subprocess. If the caller's environment already configures an
+// Application ID (e.g. an operator who is also an AWS Partner and wants
+// their own revenue attribution), Coder's value is appended with a space
+// delimiter so both attributions are preserved. Otherwise Coder's value is
+// used on its own.
+//
+// See: https://docs.aws.amazon.com/PRM/latest/aws-prm-onboarding-guide/automated-user-agent.html
+func awsSDKUserAgentEnv(existing string) string {
+	if existing == "" {
+		return awsSDKUserAgentEnvKey + "=" + awsSDKUserAgentCoder
+	}
+	return awsSDKUserAgentEnvKey + "=" + existing + " " + awsSDKUserAgentCoder
+}
diff --git a/provisioner/terraform/safeenv_internal_test.go b/provisioner/terraform/safeenv_internal_test.go
new file mode 100644
index 0000000000..1863f8fee1
--- /dev/null
+++ b/provisioner/terraform/safeenv_internal_test.go
@@ -0,0 +1,44 @@
+package terraform
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSafeEnvironValue(t *testing.T) {
+	t.Parallel()
+
+	env := []string{
+		"FOO=bar",
+		"AWS_SDK_UA_APP_ID=my-existing-id",
+		"BAZ=qux",
+	}
+	require.Equal(t, "my-existing-id", safeEnvironValue(env, "AWS_SDK_UA_APP_ID"))
+	require.Equal(t, "bar", safeEnvironValue(env, "FOO"))
+	require.Equal(t, "", safeEnvironValue(env, "MISSING"))
+}
+
+func TestAWSSDKUserAgentEnv(t *testing.T) {
+	t.Parallel()
+
+	t.Run("NoExisting", func(t *testing.T) {
+		t.Parallel()
+		require.Equal(t,
+			"AWS_SDK_UA_APP_ID=APN_1.1/pc_cdfmjwn8i6u8l9fwz8h82e4w3$",
+			awsSDKUserAgentEnv(""),
+		)
+	})
+
+	t.Run("AppendToExisting", func(t *testing.T) {
+		t.Parallel()
+		// When the operator is themselves an AWS Partner and has set their own
+		// Application ID, we append Coder's with a space delimiter so both
+		// attributions are preserved. See:
+		// https://docs.aws.amazon.com/PRM/latest/aws-prm-onboarding-guide/automated-user-agent.html
+		require.Equal(t,
+			"AWS_SDK_UA_APP_ID=EXISTING_APP_ID APN_1.1/pc_cdfmjwn8i6u8l9fwz8h82e4w3$",
+			awsSDKUserAgentEnv("EXISTING_APP_ID"),
+		)
+	})
+}