Built-in Functions

Terraform ships a library of built-in functions — string, collection, numeric, encoding, filesystem, and date families — and you call them inline anywhere an expression is allowed. There is no syntax for defining your own function in Terraform 1.x: you compose the built-ins, and you push genuinely reusable logic into a module.

Two functions earn their keep on GCP above all the rest. jsonencode builds IAM policies and other JSON arguments with correct escaping, and templatefile renders external files so a startup script or config stays a reviewable file instead of a wall of heredoc inside the .tf. The rest of the library is everyday shaping of labels, names, and lists.

String and Collection Families

The string family covers the everyday reshaping of names and labels: lower, replace, format, join and split, trimspace. The collection family does the same for lists and maps: merge, concat, keys, values, lookup, contains, flatten, distinct. These are the functions you reach for constantly to shape an input into the exact form a resource argument wants.

Encoding Functions

The encoding family — jsonencode and jsondecode, base64encode, yamlencode, urlencode — converts between HCL values and serialized formats. jsonencode is the one you reach for repeatedly on GCP, because IAM policies and many resource arguments want correctly-escaped JSON, and building that JSON by hand is where quoting bugs live.

jsonencode for GCP Policy Documents

Building a google_project_iam_policy document or a custom-role permission set as an HCL object and wrapping it in jsonencode produces valid JSON with correct quoting — instead of a fragile hand-built string that breaks the moment a value contains a quote or a trailing comma lands wrong. The reverse, jsondecode(file(...)), reads an external policy file back into HCL so you can manage it as data.

locals {
  processor_policy = jsonencode({
    bindings = [{
      role    = "roles/pubsub.publisher"
      members = ["serviceAccount:${google_service_account.processor.email}"]
    }]
  })   # correct escaping, no hand-built quotes
}

The object is readable HCL; jsonencode turns it into valid JSON. The service-account email interpolates cleanly, and there is no trailing-comma or quote-escaping bug to chase.

templatefile

templatefile renders an external template file with a set of variables — the clean way to produce a Cloud Run startup config, a cloud-init, or a parameterized SQL or JSON file without cramming multi-line content into the .tf. The template lives as its own reviewable file, and the resource passes it the values it needs.

resource "google_compute_instance" "runner" {
  # ... 
  metadata_startup_script = templatefile("${path.module}/startup.sh.tftpl", {
    bucket = google_storage_bucket.raw.name
  })
}

The startup script stays a file a reviewer can read on its own, and Terraform substitutes bucket at plan time. Inlining the same script as a heredoc would bury it in the resource block and lose the separate review.

try, can, and coalesce

Three functions handle optional and missing data gracefully. can(...) turns an error into a boolean — the reason a regex check works inside a validation block. try(a, b, c) returns the first expression that does not error, useful when an attribute may or may not exist. coalesce and coalescelist return the first non-null argument, the tool for falling back from an optional input to a default. Reaching for these beats letting a missing-key lookup abort the whole plan.

No User-Defined Functions

Terraform 1.x has no way to define your own function in HCL — there is no function "..." {} block, and OpenTofu has none either. When you find yourself repeating a gnarly built-in composition, the answer is to factor the logic into a module or repeat the composition. The closest thing either offers is provider-defined functions — functions a provider registers that you call as provider::name::func — but those come from a provider plugin, not from your own HCL. OpenTofu pushes this further with experimental dynamic providers (Lua, Go) that let a provider compute functions from your config, a divergence from Terraform; still, neither tool lets you name a reusable expression inline.