diff --git a/.changelog/15806.txt b/.changelog/15806.txt
new file mode 100644
index 00000000000..78b8e24ec1a
--- /dev/null
+++ b/.changelog/15806.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_vpn_connection: Mark `customer_gateway_configuration` as [`Sensitive`](https://www.terraform.io/plugin/sdkv2/best-practices/sensitive-state#using-the-sensitive-flag)
+```
\ No newline at end of file
diff --git a/internal/service/ec2/vpn_connection.go b/internal/service/ec2/vpn_connection.go
index abce1fb2765..2db39599286 100644
--- a/internal/service/ec2/vpn_connection.go
+++ b/internal/service/ec2/vpn_connection.go
@@ -37,8 +37,9 @@ func ResourceVPNConnection() *schema.Resource {
 				Computed: true,
 			},
 			"customer_gateway_configuration": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:      schema.TypeString,
+				Sensitive: true,
+				Computed:  true,
 			},
 			"customer_gateway_id": {
 				Type:     schema.TypeString,