From d76a8fcf6cc2d280ca41686780e5144451e35327 Mon Sep 17 00:00:00 2001
From: James Bardin <j.bardin@gmail.com>
Date: Thu, 6 May 2021 11:08:20 -0400
Subject: [PATCH] null check in ValueMarks

---
 configs/configschema/marks.go      | 3 +++
 configs/configschema/marks_test.go | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/configs/configschema/marks.go b/configs/configschema/marks.go
index 8b468ec9f..bf8f81568 100644
--- a/configs/configschema/marks.go
+++ b/configs/configschema/marks.go
@@ -24,6 +24,9 @@ func (b *Block) ValueMarks(val cty.Value, path cty.Path) []cty.PathValueMarks {
 		}
 	}
 
+	if val.IsNull() {
+		return pvm
+	}
 	for name, blockS := range b.BlockTypes {
 		// If our block doesn't contain any sensitive attributes, skip inspecting it
 		if !blockS.Block.ContainsSensitive() {
diff --git a/configs/configschema/marks_test.go b/configs/configschema/marks_test.go
index 9a21e4518..b5c672c3b 100644
--- a/configs/configschema/marks_test.go
+++ b/configs/configschema/marks_test.go
@@ -47,6 +47,10 @@ func TestBlockValueMarks(t *testing.T) {
 			cty.UnknownVal(schema.ImpliedType()),
 			cty.UnknownVal(schema.ImpliedType()),
 		},
+		{
+			cty.NullVal(schema.ImpliedType()),
+			cty.NullVal(schema.ImpliedType()),
+		},
 		{
 			cty.ObjectVal(map[string]cty.Value{
 				"sensitive":   cty.UnknownVal(cty.String),