diff --git a/.changelog/3462.txt b/.changelog/3462.txt
new file mode 100644
index 00000000000..ee5f9f5937d
--- /dev/null
+++ b/.changelog/3462.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+storage: Marked the credentials field in `google_storage_object_signed_url` as sensitive so it doesn't expose private credentials.
+```
diff --git a/google/data_source_storage_object_signed_url.go b/google/data_source_storage_object_signed_url.go
index b57d314e6cf..a14a0ec5dd1 100644
--- a/google/data_source_storage_object_signed_url.go
+++ b/google/data_source_storage_object_signed_url.go
@@ -51,8 +51,9 @@ func dataSourceGoogleSignedUrl() *schema.Resource {
 				Default:  "",
 			},
 			"credentials": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:      schema.TypeString,
+				Sensitive: true,
+				Optional:  true,
 			},
 			"duration": {
 				Type:     schema.TypeString,