diff --git a/internal/provider/data_source_local_file.go b/internal/provider/data_source_local_file.go
index ed32530b..1f3ebb2c 100644
--- a/internal/provider/data_source_local_file.go
+++ b/internal/provider/data_source_local_file.go
@@ -31,15 +31,22 @@ func dataSourceLocalFile() *schema.Resource {
 				Computed:    true,
 			},
 			"sensitive_content": {
-				Type:      schema.TypeString,
-				Sensitive: true,
-				Computed:  true,
+				Type:        schema.TypeString,
+				Description: "The raw content of the file that was read, if sensitive is true. Otherwise an empty string.",
+				Sensitive:   true,
+				Computed:    true,
 			},
 			"content_base64": {
 				Type:        schema.TypeString,
 				Description: "The base64 encoded version of the file content (use this when dealing with binary data).",
 				Computed:    true,
 			},
+			"sensitive_content_base64": {
+				Type:        schema.TypeString,
+				Description: "The base64 encoded version of the file content, if sensitive is true. Otherwise an empty string.",
+				Sensitive:   true,
+				Computed:    true,
+			},
 		},
 	}
 }
@@ -53,10 +60,11 @@ func dataSourceLocalFileRead(d *schema.ResourceData, _ interface{}) error {
 	sensitive := d.Get("sensitive").(bool)
 	if sensitive {
 		d.Set("sensitive_content", string(content))
+		d.Set("sensitive_content_base64", base64.StdEncoding.EncodeToString(content))
 	} else {
 		d.Set("content", string(content))
+		d.Set("content_base64", base64.StdEncoding.EncodeToString(content))
 	}
-	d.Set("content_base64", base64.StdEncoding.EncodeToString(content))
 
 	checksum := sha1.Sum([]byte(content))
 	d.SetId(hex.EncodeToString(checksum[:]))
diff --git a/internal/provider/data_source_local_file_test.go b/internal/provider/data_source_local_file_test.go
index da86dd37..6fad1352 100644
--- a/internal/provider/data_source_local_file_test.go
+++ b/internal/provider/data_source_local_file_test.go
@@ -34,6 +34,12 @@ data "local_file" "file" {
 					if got, want := i.Attributes["content_base64"], base64.StdEncoding.EncodeToString([]byte(content)); got != want {
 						return fmt.Errorf("wrong content_base64 %q; want %q", got, want)
 					}
+					if got, want := i.Attributes["sensitive_content"], ""; got != want {
+						return fmt.Errorf("Content was not marked as sensitive and should be in 'content' attribute instead")
+					}
+					if got, want := i.Attributes["sensitive_content_base64"], ""; got != want {
+						return fmt.Errorf("Content was marked as sensitive and should be in 'content_base64' attribute instead")
+					}
 					return nil
 				},
 			},
@@ -64,10 +70,13 @@ func TestLocalFileSensitiveDataSource(t *testing.T) {
 					if got, want := i.Attributes["content"], ""; got != want {
 						return fmt.Errorf("Content was marked as sensitive and should not be returned in 'content' attribute")
 					}
+					if got, want := i.Attributes["content_base64"], ""; got != want {
+						return fmt.Errorf("Content was marked as sensitive and should not be returned in 'content_base64' attribute")
+					}
 					if got, want := i.Attributes["sensitive_content"], content; got != want {
 						return fmt.Errorf("wrong content %q; want %q", got, want)
 					}
-					if got, want := i.Attributes["content_base64"], base64.StdEncoding.EncodeToString([]byte(content)); got != want {
+					if got, want := i.Attributes["sensitive_content_base64"], base64.StdEncoding.EncodeToString([]byte(content)); got != want {
 						return fmt.Errorf("wrong content_base64 %q; want %q", got, want)
 					}
 					return nil
diff --git a/website/docs/d/file.html.md b/website/docs/d/file.html.md
index d373833b..2e78f40a 100644
--- a/website/docs/d/file.html.md
+++ b/website/docs/d/file.html.md
@@ -52,8 +52,9 @@ The following arguments are supported:
 The following attribute is exported:
 
 * `content` - The raw content of the file that was read. It will be an empty string if `sensitive` is true.
-* `content_base64` - The base64 encoded version of the file content (use this when dealing with binary data).
+* `content_base64` - The base64 encoded version of the file content (use this when dealing with binary data). It will be an empty string if `sensitive` is true.
 * `sensitive_content` - This will be populated with the raw content of the file  only when the `sensitive` argument is set to `true`. Otherwise it will be an empty string.
+* `sensitive_content_base64` - This will be populated with the base64 encoded version of the file content only when the `sensitive` argument is set to `true`. Otherwise it will be an empty string.
 
 The content of the file must be valid UTF-8 due to Terraform's assumptions
 about string encoding. Files that do not contain UTF-8 text will have invalid