diff --git a/configs/configschema/marks.go b/configs/configschema/marks.go
index 8b468ec9f..bf8f81568 100644
--- a/configs/configschema/marks.go
+++ b/configs/configschema/marks.go
@@ -24,6 +24,9 @@ func (b *Block) ValueMarks(val cty.Value, path cty.Path) []cty.PathValueMarks {
 		}
 	}
 
+	if val.IsNull() {
+		return pvm
+	}
 	for name, blockS := range b.BlockTypes {
 		// If our block doesn't contain any sensitive attributes, skip inspecting it
 		if !blockS.Block.ContainsSensitive() {
diff --git a/configs/configschema/marks_test.go b/configs/configschema/marks_test.go
index 9a21e4518..b5c672c3b 100644
--- a/configs/configschema/marks_test.go
+++ b/configs/configschema/marks_test.go
@@ -47,6 +47,10 @@ func TestBlockValueMarks(t *testing.T) {
 			cty.UnknownVal(schema.ImpliedType()),
 			cty.UnknownVal(schema.ImpliedType()),
 		},
+		{
+			cty.NullVal(schema.ImpliedType()),
+			cty.NullVal(schema.ImpliedType()),
+		},
 		{
 			cty.ObjectVal(map[string]cty.Value{
 				"sensitive":   cty.UnknownVal(cty.String),