@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+/**
+ * Serializes an object key fragment as the inner content of a Terraform
+ * quoted-string literal, without the surrounding quotes.
+ *
+ * `JSON.stringify` covers quotes, backslashes and most control characters.
+ * Terraform quoted strings reject the `\b` and `\f` escapes that JSON emits, so
+ * those use four-digit Unicode escapes. `$${` and `%%{` are the Terraform
+ * escapes for sequences that would otherwise start a template interpolation or
+ * directive.
+ *
+ * Set `keepTemplates` when the fragment may hold a resolved token, which
+ * renders as a `${...}` reference that must stay an interpolation.
+ */
+export function quotedStringKeyFragment(
+  fragment: string,
+  keepTemplates = false,
+): string {
+  // Replacer functions, not replacement strings: in a replacement string `$$`
+  // is itself an escape for a literal `$` and would undo the escape below.
+  const escaped = JSON.stringify(fragment)
+    .slice(1, -1)
+    .replace(/\\(\\|b|f)/g, (match, selector: string) =>
+      selector === "b" ? "\\u0008" : selector === "f" ? "\\u000c" : match,
+    );
+  if (keepTemplates) {
+    return escaped;
+  }
+  return escaped.replace(/\$\{/g, () => "$${").replace(/%\{/g, () => "%%{");
+}
+
+/**
+ * Serializes an object key as a Terraform quoted-string literal.
+ *
+ * Set `keepTemplates` when the key may hold a resolved token, which renders as
+ * a `${...}` reference that must stay an interpolation.
+ */
+export function quotedStringKey(key: string, keepTemplates = false): string {
+  return `"${quotedStringKeyFragment(key, keepTemplates)}"`;
+}
@@ -2,6 +2,7 @@
  * Copyright (c) HashiCorp, Inc.
  * SPDX-License-Identifier: MPL-2.0
  */
+import { quotedStringKey } from "./quoted-string-key";
 import { Tokenization } from "../tokens/token";
 
 /**
@@ -19,7 +20,16 @@ function escapeQuotes(str: string): string {
  *
  */
 function wrapIdentifierInQuotesIfNeeded(key: string): string {
-  return /(^\d)|[^A-Za-z0-9_-]/.test(key) ? `"${key}"` : key;
+  if (!/(^\d)|[^A-Za-z0-9_-]/.test(key)) {
+    return key;
+  }
+  // A key containing `${` may be a resolved token reference rather than a
+  // literal string, so its `${...}` body is expression syntax, not text to
+  // escape. Leave it on the old (unescaped) path to avoid corrupting it.
+  if (key.includes("${")) {
+    return `"${key}"`;
+  }
+  return quotedStringKey(key, true);
 }
 
 /**
 
@@ -7,27 +7,13 @@ import { App } from "./app";
 import { TerraformStack } from "./terraform-stack";
 import { ITerraformDependable } from "./terraform-dependable";
 import { Construct } from "constructs";
+import {
+  quotedStringKey,
+  quotedStringKeyFragment,
+} from "./hcl/quoted-string-key";
 
 const TERRAFORM_IDENTIFIER_REGEX = /^[_a-zA-Z][_a-zA-Z0-9]*$/;
 
-/**
- * Serializes an object key as a Terraform quoted-string literal:
- * `JSON.stringify` covers quotes, backslashes and control characters, and
- * `$${`/`%%{` are Terraform's own escapes for what would otherwise become
- * template interpolation/directive sequences inside the quoted string. The
- * pre-existing direct-object branches of `resolveExpressionPart` still
- * interpolate keys unescaped - tracked in
- * https://github.com/open-constructs/cdk-terrain/issues/350.
- */
-function quotedStringKey(key: string): string {
-  // Replacer functions, not replacement strings: in a replacement string
-  // `$$` is itself an escape (for a literal `$`), so `"$${"` would emit
-  // just `${` - silently undoing the escape this exists to produce.
-  return JSON.stringify(key)
-    .replace(/\$\{/g, () => "$${")
-    .replace(/%\{/g, () => "%%{");
-}
-
 // eslint-disable-next-line jsdoc/require-jsdoc
 class TFExpression extends Intrinsic implements IResolvable {
   protected resolveExpressionPart(context: IResolveContext, arg: any): string {
@@ -73,7 +59,7 @@ class TFExpression extends Intrinsic implements IResolvable {
         return `{${Object.keys(resolvedArg)
           .map(
             (key) =>
-              `${quotedStringKey(key)} = ${this.resolveArg(context, resolvedArg[key])}`,
+              `${this.resolveObjectKey(context, key)} = ${this.resolveArg(context, resolvedArg[key])}`,
           )
           .join(", ")}}`;
       }
@@ -86,8 +72,21 @@ class TFExpression extends Intrinsic implements IResolvable {
     }
 
     if (typeof resolvedArg === "object" && resolvedArg !== null) {
-      return `{${Object.keys(resolvedArg)
-        .map((key) => `"${key}" = ${this.resolveArg(context, arg[key])}`)
+      // Use arg's own keys, not resolvedArg's: context.resolve() deep-resolves
+      // object keys too, replacing a token placeholder with its resolved
+      // reference text and dropping the `${...}` wrapper, so resolvedArg's
+      // keys no longer look like tokens and no longer match `arg`'s.
+      // context.resolve() also drops undefined-valued entries (mirroring
+      // JSON.stringify), so filter those out here to match resolvedArg's keys.
+      // A resolvable value (e.g. Lazy.anyValue()) only reveals `undefined`
+      // once resolved, so resolve the value - not just check `arg[key]` - to
+      // detect it.
+      return `{${Object.keys(arg)
+        .filter((key) => context.resolve(arg[key]) !== undefined)
+        .map(
+          (key) =>
+            `${this.resolveObjectKey(context, key)} = ${this.resolveArg(context, arg[key])}`,
+        )
         .join(", ")}}`;
     }
 
@@ -120,6 +119,72 @@ class TFExpression extends Intrinsic implements IResolvable {
     return this.resolveExpressionPart(context, arg);
   }
 
+  // An object key built from a token (e.g. `{[res.id]: "v"}`) is a JS string
+  // holding the token's placeholder by the time it reaches here, and reads
+  // identically to a literal key unless we check for the placeholder.
+  // HCL has no object-key interpolation syntax, so a token key can only be
+  // expressed as a parenthesised key expression, e.g. `(resource.id) = "v"`.
+  private resolveObjectKey(context: IResolveContext, key: string): string {
+    const tokenList = Tokenization.reverseString(key);
+    const hasToken = tokenList.tokens.length + tokenList.intrinsic.length > 0;
+
+    if (!hasToken) {
+      return quotedStringKey(key);
+    }
+
+    return `(${this.resolveTokenKey(context, key)})`;
+  }
+
+  // A mixed literal/token key (e.g. `{[`prefix-${res.id}`]: "v"}`) must stay a
+  // key expression, not go through resolveArg()'s resolveString(), which
+  // escapes a literal fragment for use as a Terraform *value* (only `\n` and
+  // `${`) rather than as a quoted-string *key* (which also needs quotes and
+  // backslashes escaped).
+  private resolveTokenKey(context: IResolveContext, key: string): string {
+    const tokenList = Tokenization.reverseString(key);
+    const numberOfTokens = tokenList.tokens.length + tokenList.intrinsic.length;
+
+    // A key that is only a token (no literal fragments) is a bare reference
+    // expression, not a quoted string - e.g. `(resource.id) = "v"`.
+    if (
+      tokenList.literals.length === 0 &&
+      tokenList.escapes.length === 0 &&
+      numberOfTokens === 1
+    ) {
+      return context.resolve(key);
+    }
+
+    const joinResult = tokenList.join({
+      join: (left, right) => {
+        const leftTokens = Tokenization.reverse(left);
+        const leftTokenList = Tokenization.reverseString(left);
+        const rightTokens = Tokenization.reverse(right);
+
+        const leftTokenCount =
+          leftTokenList.intrinsic.length + leftTokenList.tokens.length;
+
+        let leftValue = left;
+
+        if (leftTokenList.literals.length === 1 && leftTokenCount === 0) {
+          leftValue = quotedStringKeyFragment(left);
+        }
+
+        if (leftTokenList.literals.length === 0 && leftTokenCount === 1) {
+          leftValue = `\${${leftTokens[0]}}`;
+        }
+
+        const rightValue =
+          rightTokens.length === 0
+            ? quotedStringKeyFragment(right)
+            : `\${${rightTokens[0]}}`;
+
+        return `${leftValue}${rightValue}`;
+      },
+    });
+
+    return `"${joinResult}"`;
+  }
+
   /**
    * Escape string removes characters from the string that are not allowed in Terraform or JSON
    * It must only be used on non-token values
 
@@ -1,6 +1,6 @@
 // Copyright (c) HashiCorp, Inc
 // SPDX-License-Identifier: MPL-2.0
-import { Testing, TerraformStack, TerraformOutput, Fn } from "../src";
+import { Testing, TerraformStack, TerraformOutput, Fn, Lazy } from "../src";
 import { TerraformVariable } from "../src/terraform-variable";
 import { TerraformLocal } from "../src/terraform-local";
 import { ref } from "../src/tfExpression";
@@ -465,6 +465,30 @@ test("undefined and null", () => {
   `);
 });
 
+test("a Lazy value that resolves to undefined omits its key, like a literal undefined", () => {
+  const app = Testing.app();
+  const stack = new TerraformStack(app, "test");
+
+  new TerraformOutput(stack, "test-output", {
+    value: Fn.merge([
+      {
+        key: Lazy.anyValue({ produce: () => undefined }),
+        b: "x",
+      },
+    ]),
+  });
+
+  expect(Testing.synth(stack)).toMatchInlineSnapshot(`
+    "{
+      "output": {
+        "test-output": {
+          "value": "\${merge({\\"b\\" = \\"x\\"})}"
+        }
+      }
+    }"
+  `);
+});
+
 describe("throws error on unescaped double quote string inputs", () => {
   const testsNotOk = ['"', '\\\\"', '\\\\\\\\"', '\\ \\\\"'];
 
 
@@ -0,0 +1,125 @@
+// Copyright (c) HashiCorp, Inc
+// SPDX-License-Identifier: MPL-2.0
+import { Construct } from "constructs";
+import { Fn, Testing, TerraformLocal, TerraformStack, Token } from "../src";
+import { quotedStringKey } from "../src/hcl/quoted-string-key";
+import { renderMap } from "../src/hcl/render";
+import { call, Expression } from "../src/tfExpression";
+import { resolve } from "../src/_tokens";
+import { TestResource } from "./helper";
+
+const stack = new TerraformStack(new Construct(undefined as any, "scope"), "s");
+const resolveExpression = (expr: Expression) => resolve(stack, expr);
+
+describe("quotedStringKey", () => {
+  it.each([
+    ["plain", `"plain"`],
+    ['he"llo', `"he\\"llo"`],
+    ["a\\b", `"a\\\\b"`],
+    ["${injected}", `"$\${injected}"`],
+    ["%{if x}", `"%%{if x}"`],
+    ["line\nbreak", `"line\\nbreak"`],
+    ["back\bspace", `"back\\u0008space"`],
+    ["form\ffeed", `"form\\u000cfeed"`],
+    ["\\b", `"\\\\b"`],
+  ])("serializes %j", (key, expected) => {
+    expect(quotedStringKey(key)).toBe(expected);
+  });
+});
+
+describe("object keys in expressions", () => {
+  it.each([
+    ['he"llo', `{"he\\"llo" = "x"}`],
+    ["${injected}", `{"$\${injected}" = "x"}`],
+    ["a\\b", `{"a\\\\b" = "x"}`],
+  ])("escapes the key %j of a direct object argument", (key, expected) => {
+    expect(resolveExpression(call("lookup", [{ [key]: "x" }]))).toBe(
+      `\${lookup(${expected})}`,
+    );
+  });
+
+  it("escapes the key of an object wrapped in a token", () => {
+    expect(
+      resolveExpression(call("lookup", [Token.asAny({ 'he"llo': "x" })])),
+    ).toBe(`\${lookup({"he\\"llo" = "x"})}`);
+  });
+
+  it("renders a pure token key as a parenthesised key expression", () => {
+    const res = new TestResource(stack, "object-keys-pure", {
+      name: "test",
+    });
+    expect(resolveExpression(call("merge", [{ [res.stringValue]: "v" }]))).toBe(
+      `\${merge({(test_resource.object-keys-pure.string_value) = "v"})}`,
+    );
+  });
+
+  it("renders a mixed literal/token key as a parenthesised interpolation", () => {
+    const res = new TestResource(stack, "object-keys-mixed", {
+      name: "test",
+    });
+    expect(
+      resolveExpression(call("merge", [{ [`pre-${res.stringValue}`]: "w" }])),
+    ).toBe(
+      `\${merge({("pre-\${test_resource.object-keys-mixed.string_value}") = "w"})}`,
+    );
+  });
+
+  it("escapes a quote in the literal fragment of a mixed key", () => {
+    const res = new TestResource(stack, "object-keys-mixed-quote", {
+      name: "test",
+    });
+    expect(
+      resolveExpression(
+        call("merge", [{ [`prefix"-${res.stringValue}`]: "w" }]),
+      ),
+    ).toBe(
+      `\${merge({("prefix\\"-\${test_resource.object-keys-mixed-quote.string_value}") = "w"})}`,
+    );
+  });
+
+  it("escapes a backslash in the literal fragment of a mixed key", () => {
+    const res = new TestResource(stack, "object-keys-mixed-backslash", {
+      name: "test",
+    });
+    expect(
+      resolveExpression(call("merge", [{ [`a\\b-${res.stringValue}`]: "w" }])),
+    ).toBe(
+      `\${merge({("a\\\\b-\${test_resource.object-keys-mixed-backslash.string_value}") = "w"})}`,
+    );
+  });
+});
+
+describe("map keys in the HCL renderer", () => {
+  it("keeps bare identifiers unquoted", () => {
+    expect(renderMap({ simple_key: "x" })).toBe(`{\nsimple_key = "x"\n}`);
+  });
+
+  it.each([
+    ['he"llo', `"he\\"llo"`],
+    ["a\\b", `"a\\\\b"`],
+    ["with space", `"with space"`],
+  ])("quotes the key %j", (key, expected) => {
+    expect(renderMap({ [key]: "x" })).toBe(`{\n${expected} = "x"\n}`);
+  });
+
+  it("keeps a function-token key with a quoted string literal parseable", () => {
+    const app = Testing.app();
+    const localStack = new TerraformStack(app, "test");
+
+    new TerraformLocal(localStack, "m", { [Fn.lower("ABC")]: "v" });
+
+    const hcl = Testing.synthHcl(localStack);
+    expect(hcl).toContain(`"\${lower("ABC")}" = "v"`);
+  });
+
+  it("keeps a resource-reference key as an interpolation", () => {
+    const app = Testing.app();
+    const localStack = new TerraformStack(app, "test");
+    const res = new TestResource(localStack, "res", { name: "test" });
+
+    new TerraformLocal(localStack, "m", { [res.stringValue]: "v" });
+
+    const hcl = Testing.synthHcl(localStack);
+    expect(hcl).toContain(`"\${test_resource.res.string_value}" = "v"`);
+  });
+});