diff --git a/resource_aws_rds_cluster.go b/resource_aws_rds_cluster.go
index <HASH>..<HASH> 100644
--- a/resource_aws_rds_cluster.go
+++ b/resource_aws_rds_cluster.go
@@ -125,8 +125,9 @@ func resourceAwsRDSCluster() *schema.Resource {
 			},
 
 			"master_password": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:      schema.TypeString,
+				Optional:  true,
+				Sensitive: true,
 			},
 
 			"snapshot_identifier": {
provider/aws: Add sensitive attribute in master_password (#<I>)