diff --git a/.changelog/3411.txt b/.changelog/3411.txt
new file mode 100644
index 0000000000..06cca400fc
--- /dev/null
+++ b/.changelog/3411.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/tencentcloud_cos_bucket_domain_certificate_attachment: set sensitive for `cert` and `private_key`
+```
diff --git a/tencentcloud/services/cos/resource_tc_cos_bucket_domain_certificate_attachment.go b/tencentcloud/services/cos/resource_tc_cos_bucket_domain_certificate_attachment.go
index be6c7a20ec..c9eba2bb86 100644
--- a/tencentcloud/services/cos/resource_tc_cos_bucket_domain_certificate_attachment.go
+++ b/tencentcloud/services/cos/resource_tc_cos_bucket_domain_certificate_attachment.go
@@ -19,8 +19,8 @@ import (
 
 func ResourceTencentCloudCosBucketDomainCertificateAttachment() *schema.Resource {
 	return &schema.Resource{
-		Read:   resourceTencentCloudCosBucketDomainCertificateAttachmentRead,
 		Create: resourceTencentCloudCosBucketDomainCertificateAttachmentCreate,
+		Read:   resourceTencentCloudCosBucketDomainCertificateAttachmentRead,
 		// Update: resourceTencentCloudCosBucketDomainCertificateAttachmentUpdate,
 		Delete: resourceTencentCloudCosBucketDomainCertificateAttachmentDelete,
 		Importer: &schema.ResourceImporter{
@@ -74,12 +74,14 @@ func ResourceTencentCloudCosBucketDomainCertificateAttachment() *schema.Resource
 													Type:        schema.TypeString,
 													Required:    true,
 													ForceNew:    true,
+													Sensitive:   true,
 													Description: "Public key of certificate.",
 												},
 												"private_key": {
 													Type:        schema.TypeString,
 													Required:    true,
 													ForceNew:    true,
+													Sensitive:   true,
 													Description: "Private key of certificate.",
 												},
 											},