diff --git a/configs/configschema/implied_type.go b/configs/configschema/implied_type.go
index 729881a031..a9efa96584 100644
--- a/configs/configschema/implied_type.go
+++ b/configs/configschema/implied_type.go
@@ -71,6 +71,9 @@ func (o *Object) ContainsSensitive() bool {
 		if attrS.Sensitive {
 			return true
 		}
+		if attrS.NestedType != nil {
+			return attrS.NestedType.ContainsSensitive()
+		}
 	}
 	return false
 }
diff --git a/configs/configschema/implied_type_test.go b/configs/configschema/implied_type_test.go
index 56316eead8..595d9dd320 100644
--- a/configs/configschema/implied_type_test.go
+++ b/configs/configschema/implied_type_test.go
@@ -178,3 +178,65 @@ func TestObjectImpliedType(t *testing.T) {
 		})
 	}
 }
+
+func TestObjectContainsSensitive(t *testing.T) {
+	tests := map[string]struct {
+		Schema *Object
+		Want   bool
+	}{
+		"object contains sensitive": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"sensitive": {Sensitive: true},
+				},
+			},
+			true,
+		},
+		"no sensitive attrs": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"insensitive": {},
+				},
+			},
+			false,
+		},
+		"nested object contains sensitive": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"nested": {
+						NestedType: &Object{
+							Attributes: map[string]*Attribute{
+								"sensitive": {Sensitive: true},
+							},
+						},
+					},
+				},
+			},
+			true,
+		},
+		"nested obj, no sensitive attrs": {
+			&Object{
+				Attributes: map[string]*Attribute{
+					"nested": {
+						NestedType: &Object{
+							Attributes: map[string]*Attribute{
+								"public": {},
+							},
+						},
+					},
+				},
+			},
+			false,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			got := test.Schema.ContainsSensitive()
+			if got != test.Want {
+				t.Errorf("wrong result\ngot:  %#v\nwant: %#v", got, test.Want)
+			}
+		})
+	}
+
+}