diff --git a/.changelog/20530.txt b/.changelog/20530.txt
new file mode 100644
index 00000000000..9a9a73d54b4
--- /dev/null
+++ b/.changelog/20530.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_user: Correctly update `passwords`
+```
\ No newline at end of file
diff --git a/aws/resource_aws_elasticache_user.go b/aws/resource_aws_elasticache_user.go
index 20eb8139a96..0d77d51ed1a 100644
--- a/aws/resource_aws_elasticache_user.go
+++ b/aws/resource_aws_elasticache_user.go
@@ -173,8 +173,8 @@ func resourceAwsElasticacheUserUpdate(d *schema.ResourceData, meta interface{})
 			hasChange = true
 		}
 
-		if d.HasChange("password") {
-			req.Passwords = expandStringSet(d.Get("password").(*schema.Set))
+		if d.HasChange("passwords") {
+			req.Passwords = expandStringSet(d.Get("passwords").(*schema.Set))
 			hasChange = true
 		}
 
@@ -190,7 +190,6 @@ func resourceAwsElasticacheUserUpdate(d *schema.ResourceData, meta interface{})
 		}
 
 	}
-
 	// Tags are currently only supported in AWS Commercial.
 	if d.HasChange("tags_all") && meta.(*AWSClient).partition == endpoints.AwsPartitionID {
 		o, n := d.GetChange("tags_all")
diff --git a/aws/resource_aws_elasticache_user_test.go b/aws/resource_aws_elasticache_user_test.go
index e7ca5feb545..e9d96830ce4 100644
--- a/aws/resource_aws_elasticache_user_test.go
+++ b/aws/resource_aws_elasticache_user_test.go
@@ -235,7 +235,7 @@ resource "aws_elasticache_user" "test" {
   user_name     = "username1"
   access_string = "on ~* +@all"
   engine        = "REDIS"
-  passwords     = ["password123456789"]
+  passwords     = ["password234567891", "password345678912"]
 }
 `, rName))
 }