diff --git a/aws/resource_aws_workspaces_directory.go b/aws/resource_aws_workspaces_directory.go
index d00cbfd05f85..a2f90e7e6964 100644
--- a/aws/resource_aws_workspaces_directory.go
+++ b/aws/resource_aws_workspaces_directory.go
@@ -419,13 +419,21 @@ func expandWorkspaceCreationProperties(properties []interface{}) *workspaces.Wor
 
 	p := properties[0].(map[string]interface{})
 
-	return &workspaces.WorkspaceCreationProperties{
-		CustomSecurityGroupId:           aws.String(p["custom_security_group_id"].(string)),
-		DefaultOu:                       aws.String(p["default_ou"].(string)),
+	result := &workspaces.WorkspaceCreationProperties{
 		EnableInternetAccess:            aws.Bool(p["enable_internet_access"].(bool)),
 		EnableMaintenanceMode:           aws.Bool(p["enable_maintenance_mode"].(bool)),
 		UserEnabledAsLocalAdministrator: aws.Bool(p["user_enabled_as_local_administrator"].(bool)),
 	}
+
+	if p["custom_security_group_id"].(string) != "" {
+		result.CustomSecurityGroupId = aws.String(p["custom_security_group_id"].(string))
+	}
+
+	if p["default_ou"].(string) != "" {
+		result.DefaultOu = aws.String(p["default_ou"].(string))
+	}
+
+	return result
 }
 
 func flattenSelfServicePermissions(permissions *workspaces.SelfservicePermissions) []interface{} {
diff --git a/aws/resource_aws_workspaces_directory_test.go b/aws/resource_aws_workspaces_directory_test.go
index 0b4f927003a4..48ed67ded791 100644
--- a/aws/resource_aws_workspaces_directory_test.go
+++ b/aws/resource_aws_workspaces_directory_test.go
@@ -283,6 +283,55 @@ func TestAccAwsWorkspacesDirectory_workspaceCreationProperties(t *testing.T) {
 	})
 }
 
+func TestAccAwsWorkspacesDirectory_workspaceCreationProperties_customSecurityGroupId_defaultOu(t *testing.T) {
+	var v workspaces.WorkspaceDirectory
+	rName := acctest.RandString(8)
+
+	resourceName := "aws_workspaces_directory.main"
+	resourceSecurityGroup := "aws_security_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+			testAccPreCheckWorkspacesDirectory(t)
+			testAccPreCheckAWSDirectoryServiceSimpleDirectory(t)
+			testAccPreCheckHasIAMRole(t, "workspaces_DefaultRole")
+		},
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAwsWorkspacesDirectoryDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWorkspacesDirectoryConfig_workspaceCreationProperties_customSecurityGroupId_defaultOu_Absent(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAwsWorkspacesDirectoryExists(resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.0.custom_security_group_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.0.default_ou", ""),
+				),
+			},
+			{
+				Config: testAccWorkspacesDirectoryConfig_workspaceCreationProperties_customSecurityGroupId_defaultOu_Present(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAwsWorkspacesDirectoryExists(resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "workspace_creation_properties.0.custom_security_group_id", resourceSecurityGroup, "id"),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.0.default_ou", "OU=AWS,DC=Workgroup,DC=Example,DC=com"),
+				),
+			},
+			{
+				Config: testAccWorkspacesDirectoryConfig_workspaceCreationProperties_customSecurityGroupId_defaultOu_Absent(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAwsWorkspacesDirectoryExists(resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "workspace_creation_properties.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "workspace_creation_properties.0.custom_security_group_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "workspace_creation_properties.0.default_ou"),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccAwsWorkspacesDirectory_ipGroupIds(t *testing.T) {
 	var v workspaces.WorkspaceDirectory
 	rName := acctest.RandString(8)
@@ -325,6 +374,181 @@ func TestAccAwsWorkspacesDirectory_ipGroupIds(t *testing.T) {
 	})
 }
 
+func TestExpandSelfServicePermissions(t *testing.T) {
+	cases := []struct {
+		input    []interface{}
+		expected *workspaces.SelfservicePermissions
+	}{
+		// Empty
+		{
+			input:    []interface{}{},
+			expected: nil,
+		},
+		// Full
+		{
+			input: []interface{}{
+				map[string]interface{}{
+					"change_compute_type":  false,
+					"increase_volume_size": false,
+					"rebuild_workspace":    true,
+					"restart_workspace":    true,
+					"switch_running_mode":  true,
+				},
+			},
+			expected: &workspaces.SelfservicePermissions{
+				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
+				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
+				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
+				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
+				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
+			},
+		},
+	}
+
+	for _, c := range cases {
+		actual := expandSelfServicePermissions(c.input)
+		if !reflect.DeepEqual(actual, c.expected) {
+			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
+		}
+	}
+}
+
+func TestFlattenSelfServicePermissions(t *testing.T) {
+	cases := []struct {
+		input    *workspaces.SelfservicePermissions
+		expected []interface{}
+	}{
+		// Empty
+		{
+			input:    nil,
+			expected: []interface{}{},
+		},
+		// Full
+		{
+			input: &workspaces.SelfservicePermissions{
+				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
+				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
+				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
+				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
+				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
+			},
+			expected: []interface{}{
+				map[string]interface{}{
+					"change_compute_type":  false,
+					"increase_volume_size": false,
+					"rebuild_workspace":    true,
+					"restart_workspace":    true,
+					"switch_running_mode":  true,
+				},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		actual := flattenSelfServicePermissions(c.input)
+		if !reflect.DeepEqual(actual, c.expected) {
+			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
+		}
+	}
+}
+
+func TestExpandWorkspaceCreationProperties(t *testing.T) {
+	cases := []struct {
+		input    []interface{}
+		expected *workspaces.WorkspaceCreationProperties
+	}{
+		// Empty
+		{
+			input:    []interface{}{},
+			expected: nil,
+		},
+		// Full
+		{
+			input: []interface{}{
+				map[string]interface{}{
+					"custom_security_group_id":            "sg-123456789012",
+					"default_ou":                          "OU=AWS,DC=Workgroup,DC=Example,DC=com",
+					"enable_internet_access":              true,
+					"enable_maintenance_mode":             true,
+					"user_enabled_as_local_administrator": true,
+				},
+			},
+			expected: &workspaces.WorkspaceCreationProperties{
+				CustomSecurityGroupId:           aws.String("sg-123456789012"),
+				DefaultOu:                       aws.String("OU=AWS,DC=Workgroup,DC=Example,DC=com"),
+				EnableInternetAccess:            aws.Bool(true),
+				EnableMaintenanceMode:           aws.Bool(true),
+				UserEnabledAsLocalAdministrator: aws.Bool(true),
+			},
+		},
+		// Without Custom Security Group ID & Default OU
+		{
+			input: []interface{}{
+				map[string]interface{}{
+					"custom_security_group_id":            "",
+					"default_ou":                          "",
+					"enable_internet_access":              true,
+					"enable_maintenance_mode":             true,
+					"user_enabled_as_local_administrator": true,
+				},
+			},
+			expected: &workspaces.WorkspaceCreationProperties{
+				CustomSecurityGroupId:           nil,
+				DefaultOu:                       nil,
+				EnableInternetAccess:            aws.Bool(true),
+				EnableMaintenanceMode:           aws.Bool(true),
+				UserEnabledAsLocalAdministrator: aws.Bool(true),
+			},
+		},
+	}
+
+	for _, c := range cases {
+		actual := expandWorkspaceCreationProperties(c.input)
+		if !reflect.DeepEqual(actual, c.expected) {
+			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
+		}
+	}
+}
+
+func TestFlattenWorkspaceCreationProperties(t *testing.T) {
+	cases := []struct {
+		input    *workspaces.DefaultWorkspaceCreationProperties
+		expected []interface{}
+	}{
+		// Empty
+		{
+			input:    nil,
+			expected: []interface{}{},
+		},
+		// Full
+		{
+			input: &workspaces.DefaultWorkspaceCreationProperties{
+				CustomSecurityGroupId:           aws.String("sg-123456789012"),
+				DefaultOu:                       aws.String("OU=AWS,DC=Workgroup,DC=Example,DC=com"),
+				EnableInternetAccess:            aws.Bool(true),
+				EnableMaintenanceMode:           aws.Bool(true),
+				UserEnabledAsLocalAdministrator: aws.Bool(true),
+			},
+			expected: []interface{}{
+				map[string]interface{}{
+					"custom_security_group_id":            "sg-123456789012",
+					"default_ou":                          "OU=AWS,DC=Workgroup,DC=Example,DC=com",
+					"enable_internet_access":              true,
+					"enable_maintenance_mode":             true,
+					"user_enabled_as_local_administrator": true,
+				},
+			},
+		},
+	}
+
+	for _, c := range cases {
+		actual := flattenWorkspaceCreationProperties(c.input)
+		if !reflect.DeepEqual(actual, c.expected) {
+			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
+		}
+	}
+}
+
 func testAccPreCheckHasIAMRole(t *testing.T, roleName string) {
 	conn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -406,84 +630,6 @@ func testAccCheckAwsWorkspacesDirectoryExists(n string, v *workspaces.WorkspaceD
 	}
 }
 
-func TestExpandSelfServicePermissions(t *testing.T) {
-	cases := []struct {
-		input    []interface{}
-		expected *workspaces.SelfservicePermissions
-	}{
-		// Empty
-		{
-			input:    []interface{}{},
-			expected: nil,
-		},
-		// Full
-		{
-			input: []interface{}{
-				map[string]interface{}{
-					"change_compute_type":  false,
-					"increase_volume_size": false,
-					"rebuild_workspace":    true,
-					"restart_workspace":    true,
-					"switch_running_mode":  true,
-				},
-			},
-			expected: &workspaces.SelfservicePermissions{
-				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
-				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
-				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
-			},
-		},
-	}
-
-	for _, c := range cases {
-		actual := expandSelfServicePermissions(c.input)
-		if !reflect.DeepEqual(actual, c.expected) {
-			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
-		}
-	}
-}
-
-func TestFlattenSelfServicePermissions(t *testing.T) {
-	cases := []struct {
-		input    *workspaces.SelfservicePermissions
-		expected []interface{}
-	}{
-		// Empty
-		{
-			input:    nil,
-			expected: []interface{}{},
-		},
-		// Full
-		{
-			input: &workspaces.SelfservicePermissions{
-				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
-				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
-				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
-			},
-			expected: []interface{}{
-				map[string]interface{}{
-					"change_compute_type":  false,
-					"increase_volume_size": false,
-					"rebuild_workspace":    true,
-					"restart_workspace":    true,
-					"switch_running_mode":  true,
-				},
-			},
-		},
-	}
-
-	for _, c := range cases {
-		actual := flattenSelfServicePermissions(c.input)
-		if !reflect.DeepEqual(actual, c.expected) {
-			t.Fatalf("expected\n\n%#+v\n\ngot\n\n%#+v", c.expected, actual)
-		}
-	}
-}
-
 func testAccPreCheckWorkspacesDirectory(t *testing.T) {
 	conn := testAccProvider.Meta().(*AWSClient).workspacesconn
 
@@ -571,6 +717,10 @@ func testAccWorkspacesDirectoryConfig(rName string) string {
 		testAccAwsWorkspacesDirectoryConfig_Prerequisites(rName), `
 resource "aws_workspaces_directory" "main" {
   directory_id = aws_directory_service_directory.main.id
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
 }
 
 data "aws_iam_role" "workspaces-default" {
@@ -592,6 +742,10 @@ resource "aws_workspaces_directory" "main" {
     restart_workspace    = false
     switch_running_mode  = true
   }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
 }
 `)
 }
@@ -654,6 +808,57 @@ resource "aws_workspaces_directory" "main" {
     enable_maintenance_mode             = false
     user_enabled_as_local_administrator = false
   }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+`, rName))
+}
+
+func testAccWorkspacesDirectoryConfig_workspaceCreationProperties_customSecurityGroupId_defaultOu_Absent(rName string) string {
+	return composeConfig(
+		testAccAwsWorkspacesDirectoryConfig_Prerequisites(rName),
+		fmt.Sprintf(`
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  workspace_creation_properties {
+    enable_internet_access              = true
+    enable_maintenance_mode             = false
+    user_enabled_as_local_administrator = false
+  }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
+}
+`, rName))
+}
+
+func testAccWorkspacesDirectoryConfig_workspaceCreationProperties_customSecurityGroupId_defaultOu_Present(rName string) string {
+	return composeConfig(
+		testAccAwsWorkspacesDirectoryConfig_Prerequisites(rName),
+		fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  vpc_id = aws_vpc.main.id
+  name   = "tf-acctest-%[1]s"
+}
+
+resource "aws_workspaces_directory" "main" {
+  directory_id = aws_directory_service_directory.main.id
+
+  workspace_creation_properties {
+    custom_security_group_id            = aws_security_group.test.id
+    default_ou                          = "OU=AWS,DC=Workgroup,DC=Example,DC=com"
+    enable_internet_access              = true
+    enable_maintenance_mode             = false
+    user_enabled_as_local_administrator = false
+  }
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
 }
 `, rName))
 }
@@ -672,6 +877,10 @@ resource "aws_workspaces_directory" "test" {
   ip_group_ids = [
     aws_workspaces_ip_group.test_alpha.id
   ]
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
 }
 `, rName))
 }
@@ -695,6 +904,10 @@ resource "aws_workspaces_directory" "test" {
     aws_workspaces_ip_group.test_beta.id,
     aws_workspaces_ip_group.test_gamma.id
   ]
+
+  tags = {
+    Name = "tf-testacc-workspaces-directory-%[1]s"
+  }
 }
 `, rName))
 }