diff --git a/third_party/terraform/resources/resource_sql_database_instance.go b/third_party/terraform/resources/resource_sql_database_instance.go
index 63f476395111..a87bb8733d93 100644
--- a/third_party/terraform/resources/resource_sql_database_instance.go
+++ b/third_party/terraform/resources/resource_sql_database_instance.go
@@ -325,6 +325,13 @@ func resourceSqlDatabaseInstance() *schema.Resource {
 				ForceNew: true,
 			},
 
+			"root_password": {
+				Type:      schema.TypeString,
+				Optional:  true,
+				ForceNew:  true,
+				Sensitive: true,
+			},
+
 			"ip_address": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -559,6 +566,11 @@ func resourceSqlDatabaseInstanceCreate(d *schema.ResourceData, meta interface{})
 		ReplicaConfiguration: expandReplicaConfiguration(d.Get("replica_configuration").([]interface{})),
 	}
 
+	// MSSQL Server require rootPassword to be set
+	if strings.Contains(instance.DatabaseVersion, "SQLSERVER") {
+		instance.RootPassword = d.Get("root_password").(string)
+	}
+
 	// Modifying a replica during Create can cause problems if the master is
 	// modified at the same time. Lock the master until we're done in order
 	// to prevent that.
diff --git a/third_party/terraform/tests/resource_sql_database_instance_test.go.erb b/third_party/terraform/tests/resource_sql_database_instance_test.go.erb
index ef50cd210f78..a11ab52ce17d 100644
--- a/third_party/terraform/tests/resource_sql_database_instance_test.go.erb
+++ b/third_party/terraform/tests/resource_sql_database_instance_test.go.erb
@@ -227,6 +227,32 @@ func TestAccSqlDatabaseInstance_basicSecondGen(t *testing.T) {
 	})
 }
 
+func TestAccSqlDatabaseInstance_basicMSSQL(t *testing.T) {
+	t.Parallel()
+
+	databaseName := "tf-test-" + acctest.RandString(10)
+	rootPassword := acctest.RandString(15)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccSqlDatabaseInstanceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: fmt.Sprintf(
+					testGoogleSqlDatabaseInstance_basic_mssql, databaseName, rootPassword),
+			},
+			{
+				ResourceName:      "google_sql_database_instance.instance",
+				ImportState:       true,
+				// ImportStateVerify check disabled as long root_password property not stored in state
+				ImportStateVerify: false,
+			},
+		},
+	})
+}
+
+
 func TestAccSqlDatabaseInstance_dontDeleteDefaultUserOnReplica(t *testing.T) {
 	t.Parallel()
 
@@ -689,6 +715,17 @@ resource "google_sql_database_instance" "instance" {
 }
 `
 
+var testGoogleSqlDatabaseInstance_basic_mssql = `
+resource "google_sql_database_instance" "instance" {
+  name             = "%s"
+  database_version = "SQLSERVER_2017_STANDARD"
+  root_password    = "%s"
+  settings {
+    tier = "db-custom-1-3840"
+  }
+}
+`
+
 func testGoogleSqlDatabaseInstanceConfig_withoutReplica(instanceName string) string {
 	return fmt.Sprintf(`resource "google_sql_database_instance" "instance" {
   name               = "%s"
diff --git a/third_party/terraform/website/docs/r/sql_database_instance.html.markdown b/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
index 8fe08ae2dd13..4498f2511fcd 100644
--- a/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
+++ b/third_party/terraform/website/docs/r/sql_database_instance.html.markdown
@@ -212,6 +212,8 @@ The following arguments are supported:
 
 * `replica_configuration` - (Optional) The configuration for replication. The
     configuration is detailed below.
+    
+* `root_password` - (Optional) Required for MS SQL Server, ignored MySQL and PostgreSQL.
 
 The required `settings` block supports: