diff --git a/.changelog/38775.txt b/.changelog/38775.txt
new file mode 100644
index 00000000000..7b6fda36aba
--- /dev/null
+++ b/.changelog/38775.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+resource/aws_grafana_workspace: Fix crash when empty `network_access_control` block is configured
+```
+```release-note:bug
+resource/aws_grafana_workspace: Fix crash when empty `vpc_configuration` block is configured
+```
diff --git a/internal/service/grafana/workspace.go b/internal/service/grafana/workspace.go
index 9a581058e7d..08b86fadde5 100644
--- a/internal/service/grafana/workspace.go
+++ b/internal/service/grafana/workspace.go
@@ -550,7 +550,7 @@ func waitWorkspaceDeleted(ctx context.Context, conn *grafana.Client, id string,
 }
 
 func expandVPCConfiguration(tfList []interface{}) *awstypes.VpcConfiguration {
-	if len(tfList) < 1 {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
@@ -581,7 +581,7 @@ func flattenVPCConfiguration(apiObject *awstypes.VpcConfiguration) []interface{}
 }
 
 func expandNetworkAccessControl(tfList []interface{}) *awstypes.NetworkAccessConfiguration {
-	if len(tfList) < 1 {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}