coder · sreya · Jun 10, 2025 · Jun 10, 2025 · Jun 12, 2025 · Jun 12, 2025
diff --git a/provisioner/terraform/resources.go b/provisioner/terraform/resources.go
@@ -184,6 +184,10 @@
 	// The label is what "terraform graph" uses to reference nodes.
 	tfResourcesByLabel := map[string]map[string]*tfjson.StateResource{}
 
+	// Map resource IDs to labels for efficient lookup when processing metadata
+	// Multiple resources can have the same ID, so we store a slice of labels
+	labelsByResourceID := map[string][]string{}
+
 	// Extra array to preserve the order of rich parameters.
 	tfResourcesRichParameters := make([]*tfjson.StateResource, 0)
 	tfResourcesPresets := make([]*tfjson.StateResource, 0)
@@ -205,6 +209,13 @@
 				tfResourcesByLabel[label] = map[string]*tfjson.StateResource{}
 			}
 			tfResourcesByLabel[label][resource.Address] = resource
+
+			// Build the ID to labels map - multiple resources can have the same ID
+			if idAttr, hasID := resource.AttributeValues["id"]; hasID {
+				if idStr, ok := idAttr.(string); ok && idStr != "" {
+					labelsByResourceID[idStr] = append(labelsByResourceID[idStr], label)
+				}
+			}
 		}
 	}
 	for _, module := range modules {
@@ -646,41 +657,68 @@
 			if err != nil {
 				return nil, xerrors.Errorf("decode metadata attributes: %w", err)
 			}
-			resourceLabel := convertAddressToLabel(resource.Address)
 
-			var attachedNode *gographviz.Node
-			for _, node := range graph.Nodes.Lookup {
-				// The node attributes surround the label with quotes.
-				if strings.Trim(node.Attrs["label"], `"`) != resourceLabel {
-					continue
+			var targetLabel string
+
+			// First, check if ResourceID is provided and try to find the resource by ID
+			if attrs.ResourceID != "" {
+				// Look for a resource with matching ID
+				foundLabels := labelsByResourceID[attrs.ResourceID]
+				if len(foundLabels) == 1 {
+					// Single match - use it
+					targetLabel = foundLabels[0]
+				} else if len(foundLabels) > 1 {
+					// Multiple resources with same ID - this creates ambiguity
+					logger.Warn(ctx, "multiple resources found with same resource_id, falling back to graph traversal",
+						slog.F("resource_id", attrs.ResourceID),
+						slog.F("metadata_address", resource.Address),
+						slog.F("matching_labels", foundLabels))
+				} else {
+					// If we couldn't find by ID, fall back to graph traversal
+					logger.Warn(ctx, "coder_metadata resource_id not found, falling back to graph traversal",
+						slog.F("resource_id", attrs.ResourceID),
+						slog.F("metadata_address", resource.Address))
 				}
-				attachedNode = node
-				break
-			}
-			if attachedNode == nil {
-				continue
 			}
-			var attachedResource *graphResource
-			for _, resource := range findResourcesInGraph(graph, tfResourcesByLabel, attachedNode.Name, 0, false) {
-				if attachedResource == nil {
-					// Default to the first resource because we have nothing to compare!
-					attachedResource = resource
-					continue
+
+			// If ResourceID wasn't provided or wasn't found, use graph traversal
+			if targetLabel == "" {
+				resourceLabel := convertAddressToLabel(resource.Address)
+
+				var attachedNode *gographviz.Node
+				for _, node := range graph.Nodes.Lookup {
+					// The node attributes surround the label with quotes.
+					if strings.Trim(node.Attrs["label"], `"`) != resourceLabel {
+						continue
+					}
+					attachedNode = node
+					break
 				}
-				if resource.Depth < attachedResource.Depth {
-					// There's a closer resource!
-					attachedResource = resource
+				if attachedNode == nil {
 					continue
 				}
-				if resource.Depth == attachedResource.Depth && resource.Label < attachedResource.Label {
-					attachedResource = resource
+				var attachedResource *graphResource
+				for _, resource := range findResourcesInGraph(graph, tfResourcesByLabel, attachedNode.Name, 0, false) {
+					if attachedResource == nil {
+						// Default to the first resource because we have nothing to compare!
+						attachedResource = resource
+						continue
+					}
+					if resource.Depth < attachedResource.Depth {
+						// There's a closer resource!
+						attachedResource = resource
+						continue
+					}
+					if resource.Depth == attachedResource.Depth && resource.Label < attachedResource.Label {
+						attachedResource = resource
+						continue
+					}
+				}
+				if attachedResource == nil {
 					continue
 				}
+				targetLabel = attachedResource.Label
 			}
-			if attachedResource == nil {
-				continue
-			}
-			targetLabel := attachedResource.Label
 
 			if metadataTargetLabels[targetLabel] {
 				return nil, xerrors.Errorf("duplicate metadata resource: %s", targetLabel)

diff --git a/provisioner/terraform/resources_test.go b/provisioner/terraform/resources_test.go
@@ -1231,24 +1231,93 @@ func TestAgentNameDuplicate(t *testing.T) {
 	require.ErrorContains(t, err, "duplicate agent name")
 }
 
-func TestMetadataResourceDuplicate(t *testing.T) {
+func TestMetadata(t *testing.T) {
 	t.Parallel()
-	ctx, logger := ctxAndLogger(t)
 
-	// Load the multiple-apps state file and edit it.
-	dir := filepath.Join("testdata", "resources", "resource-metadata-duplicate")
-	tfPlanRaw, err := os.ReadFile(filepath.Join(dir, "resource-metadata-duplicate.tfplan.json"))
-	require.NoError(t, err)
-	var tfPlan tfjson.Plan
-	err = json.Unmarshal(tfPlanRaw, &tfPlan)
-	require.NoError(t, err)
-	tfPlanGraph, err := os.ReadFile(filepath.Join(dir, "resource-metadata-duplicate.tfplan.dot"))
-	require.NoError(t, err)
+	t.Run("Duplicate", func(t *testing.T) {
+		t.Parallel()
+		ctx, logger := ctxAndLogger(t)
+		// Load the multiple-apps state file and edit it.
+		dir := filepath.Join("testdata", "resources", "resource-metadata-duplicate")
+		tfPlanRaw, err := os.ReadFile(filepath.Join(dir, "resource-metadata-duplicate.tfplan.json"))
+		require.NoError(t, err)
+		var tfPlan tfjson.Plan
+		err = json.Unmarshal(tfPlanRaw, &tfPlan)
+		require.NoError(t, err)
+		tfPlanGraph, err := os.ReadFile(filepath.Join(dir, "resource-metadata-duplicate.tfplan.dot"))
+		require.NoError(t, err)
 
-	state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfPlan.PlannedValues.RootModule}, string(tfPlanGraph), logger)
-	require.Nil(t, state)
-	require.Error(t, err)
-	require.ErrorContains(t, err, "duplicate metadata resource: null_resource.about")
+		state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfPlan.PlannedValues.RootModule}, string(tfPlanGraph), logger)
+		require.Nil(t, state)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "duplicate metadata resource: null_resource.about")
+	})
+
+	t.Run("ResourceID", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			ctx, logger := ctxAndLogger(t)
+
+			dir := filepath.Join("testdata", "resources", "resource-id-provided")
+			tfStateRaw, err := os.ReadFile(filepath.Join(dir, "resource-id-provided.tfstate.json"))
+			require.NoError(t, err)
+			var tfState tfjson.State
+			err = json.Unmarshal(tfStateRaw, &tfState)
+			require.NoError(t, err)
+			tfStateGraph, err := os.ReadFile(filepath.Join(dir, "resource-id-provided.tfstate.dot"))
+			require.NoError(t, err)
+
+			state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfState.Values.RootModule}, string(tfStateGraph), logger)
+			require.NoError(t, err)
+			require.Len(t, state.Resources, 2)
+
+			// Find the resources
+			var firstResource, secondResource *proto.Resource
+			for _, res := range state.Resources {
+				if res.Name == "first" && res.Type == "null_resource" {
+					firstResource = res
+				} else if res.Name == "second" && res.Type == "null_resource" {
+					secondResource = res
+				}
+			}
+
+			require.NotNil(t, firstResource)
+			require.NotNil(t, secondResource)
+
+			// The metadata should be on the second resource (as specified by resource_id),
+			// not the first one (which is the closest in the graph)
+			require.Len(t, firstResource.Metadata, 0, "first resource should have no metadata")
+			require.Len(t, secondResource.Metadata, 1, "second resource should have metadata")
+			require.Equal(t, "test", secondResource.Metadata[0].Key)
+			require.Equal(t, "value", secondResource.Metadata[0].Value)
+		})
+
+		t.Run("NotFound", func(t *testing.T) {
+			t.Parallel()
+			ctx, logger := ctxAndLogger(t)
+
+			dir := filepath.Join("testdata", "resources", "resource-id-not-found")
+			tfStateRaw, err := os.ReadFile(filepath.Join(dir, "resource-id-not-found.tfstate.json"))
+			require.NoError(t, err)
+			var tfState tfjson.State
+			err = json.Unmarshal(tfStateRaw, &tfState)
+			require.NoError(t, err)
+			tfStateGraph, err := os.ReadFile(filepath.Join(dir, "resource-id-not-found.tfstate.dot"))
+			require.NoError(t, err)
+
+			state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfState.Values.RootModule}, string(tfStateGraph), logger)
+			require.NoError(t, err)
+			require.Len(t, state.Resources, 1)
+
+			// The metadata should still be applied via graph traversal
+			require.Equal(t, "example", state.Resources[0].Name)
+			require.Len(t, state.Resources[0].Metadata, 1)
+			require.Equal(t, "test", state.Resources[0].Metadata[0].Key)
+			require.Equal(t, "value", state.Resources[0].Metadata[0].Value)
+		})
+	})
 }
 
 func TestParameterValidation(t *testing.T) {

diff --git a/provisioner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tf b/provisioner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">=2.0.0"
+    }
+  }
+}
+
+resource "null_resource" "example" {}
+
+resource "coder_metadata" "example" {
+  resource_id = "non-existent-id"
+  depends_on  = [null_resource.example]
+  item {
+    key   = "test"
+    value = "value"
+  }
+}
diff --git a/...ioner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfplan.dot b/...ioner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfplan.dot
diff --git a/...oner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfplan.json b/...oner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfplan.json
diff --git a/...oner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfstate.dot b/...oner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfstate.dot
diff --git a/...ner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfstate.json b/...ner/terraform/testdata/resources/resource-id-not-found/resource-id-not-found.tfstate.json
diff --git a/provisioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tf b/provisioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tf
@@ -0,0 +1,21 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">=2.0.0"
+    }
+  }
+}
+
+resource "null_resource" "first" {}
+
+resource "null_resource" "second" {}
+
+resource "coder_metadata" "example" {
+  resource_id = null_resource.second.id
+  depends_on  = [null_resource.first]
+  item {
+    key   = "test"
+    value = "value"
+  }
+}
diff --git a/...isioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tfplan.dot b/...isioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tfplan.dot
diff --git a/...sioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tfplan.json b/...sioner/terraform/testdata/resources/resource-id-provided/resource-id-provided.tfplan.json