diff --git a/.changelog/24274.txt b/.changelog/24274.txt
new file mode 100644
index 000000000000..4c0fe678aff5
--- /dev/null
+++ b/.changelog/24274.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_user: Add plan-time validation of password argumnet length
+```
\ No newline at end of file
diff --git a/internal/service/elasticache/user.go b/internal/service/elasticache/user.go
index e071df97fd76..aad9f7802ec4 100644
--- a/internal/service/elasticache/user.go
+++ b/internal/service/elasticache/user.go
@@ -53,10 +53,13 @@ func ResourceUser() *schema.Resource {
 				Default:  false,
 			},
 			"passwords": {
-				Type:      schema.TypeSet,
-				Optional:  true,
-				MaxItems:  2,
-				Elem:      &schema.Schema{Type: schema.TypeString},
+				Type:     schema.TypeSet,
+				Optional: true,
+				MaxItems: 2,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.StringLenBetween(16, 128),
+				},
 				Sensitive: true,
 			},
 			"tags":     tftags.TagsSchema(),