diff --git a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
index e7f7ac88a574..939cba3fa0ad 100644
--- a/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
+++ b/mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb
@@ -775,11 +775,12 @@ is set to true. Defaults to ZONAL.`,
 			},
 
 			"replica_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
+				Type:       schema.TypeList,
+				Optional:   true,
+				MaxItems:   1,
 				// Returned from API on all replicas
-				Computed: true,
+				Computed:   true,
+				Sensitive:  true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"ca_certificate": {
@@ -787,7 +788,6 @@ is set to true. Defaults to ZONAL.`,
 							Optional:     true,
 							ForceNew:     true,
 							AtLeastOneOf: replicaConfigurationKeys,
-							Sensitive:    true,
 							Description:  `PEM representation of the trusted CA's x509 certificate.`,
 						},
 						"client_certificate": {
@@ -795,7 +795,6 @@ is set to true. Defaults to ZONAL.`,
 							Optional:     true,
 							ForceNew:     true,
 							AtLeastOneOf: replicaConfigurationKeys,
-							Sensitive:    true,
 							Description:  `PEM representation of the replica's x509 certificate.`,
 						},
 						"client_key": {
@@ -803,7 +802,6 @@ is set to true. Defaults to ZONAL.`,
 							Optional:     true,
 							ForceNew:     true,
 							AtLeastOneOf: replicaConfigurationKeys,
-							Sensitive:    true,
 							Description:  `PEM representation of the replica's private key. The corresponding public key in encoded in the client_certificate.`,
 						},
 						"connect_retry_interval": {