feat(aws): use DEFANG_AWS_APN_ID for AWS resource tagging

[lionello]

Description

Introduce DEFANG_AWS_APN_ID environment variable, passed to CD task for tagging AWS resources during AWS deployments. Added aws_apn_id to CanIUse rpc response for customers that bought Defang Pro through the AWS Marketplace.

Linked Issues

Fixes #2154

Checklist

• I have performed a self-review of my code
• I have added appropriate tests
• I have updated the Defang CLI docs and/or README to reflect my changes, if necessary

Summary by CodeRabbit

• New Features

  • Added support for configuring AWS APN attribution via a new environment variable.
  • This value can now be passed through to deployment and build environments when available.

• Documentation

  • Updated environment variable documentation in the main, package, and source READMEs with the new setting and example format.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d88fa098-c28a-4e56-af46-67df8eb7a483

📥 Commits

Reviewing files that changed from the base of the PR and between 9b104ee and 6d2c3fd.

⛔ Files ignored due to path filters (1)

• src/protos/io/defang/v1/fabric.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (6)

• README.md
• pkgs/npm/README.md
• src/README.md
• src/pkg/cli/client/byoc/aws/byoc.go
• src/pkg/cli/client/byoc/baseclient.go
• src/protos/io/defang/v1/fabric.proto

---

📝 Walkthrough

Walkthrough

The PR adds aws_apn_id to the CanIUse response and BYOC config, forwards DEFANG_AWS_APN_ID into the CodeBuild environment in runCdCommand(), and documents the new variable in three README files.

Changes

AWS APN ID attribution

Layer / File(s)	Summary
Response contract, config field, and docs src/protos/io/defang/v1/fabric.proto, src/pkg/cli/client/byoc/baseclient.go, README.md, pkgs/npm/README.md, src/README.md	CanIUseResponse adds aws_apn_id, CanIUseConfig adds AwsApnId and is populated from quotas.AwsApnId, and the environment-variable lists document DEFANG_AWS_APN_ID.
BYOC env propagation src/pkg/cli/client/byoc/aws/byoc.go	environment() adds a blank line in the Pulumi backend setup area, and runCdCommand() populates DEFANG_AWS_APN_ID from the process environment or b.CanIUseConfig.AwsApnId.

Sequence Diagram(s)

sequenceDiagram
  participant CanIUseResponse
  participant ByocBaseClient
  participant runCdCommand
  CanIUseResponse->>ByocBaseClient: set AwsApnId from aws_apn_id
  ByocBaseClient->>runCdCommand: expose CanIUseConfig.AwsApnId
  runCdCommand->>runCdCommand: populate DEFANG_AWS_APN_ID

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• DefangLabs/defang#1943: Also modifies src/pkg/cli/client/byoc/aws/byoc.go's runCdCommand() to inject an environment variable into the CodeBuild environment.

Suggested reviewers

• jordanstephens
• edwardrf

Poem

A rabbit hopped through config light,
With APN IDs tucked in tight.
From proto to env, the trail runs true,
DEFANG_AWS_APN_ID now peeks through. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: introducing DEFANG_AWS_APN_ID for AWS tagging attribution.
Linked Issues check	✅ Passed	The code and docs add DEFANG_AWS_APN_ID support and pass it into AWS deployment flows as requested in #2154.
Out of Scope Changes check	✅ Passed	The changes are focused on DEFANG_AWS_APN_ID support, with only documentation and a minor formatting tweak beyond the functional update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lio/apn-id

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=warning msg="The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2."
level=warning msg="Suggested new configuration:\nlinters:\n enable:\n - gomodguard_v2\n"
level=warning msg="[linters_context] running gomodguard failed: unable to read module file go.mod: current working directory must have a go.mod file: if you are not using go modules it is suggested to disable this linter"
level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands.}