diff --git a/.changelog/41546.txt b/.changelog/41546.txt
new file mode 100644
index 00000000000..1595fb324a0
--- /dev/null
+++ b/.changelog/41546.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ephemeral/aws_secrets_manager_random_password: Change `exclude_characters` from `Bool` to `String`
+```
diff --git a/internal/service/secretsmanager/random_password_ephemeral.go b/internal/service/secretsmanager/random_password_ephemeral.go
index bc0390d77df..134200677ac 100644
--- a/internal/service/secretsmanager/random_password_ephemeral.go
+++ b/internal/service/secretsmanager/random_password_ephemeral.go
@@ -32,7 +32,7 @@ type ephemeralRandomPassword struct {
 func (e *ephemeralRandomPassword) Schema(ctx context.Context, req ephemeral.SchemaRequest, resp *ephemeral.SchemaResponse) {
 	resp.Schema = schema.Schema{
 		Attributes: map[string]schema.Attribute{
-			"exclude_characters": schema.BoolAttribute{
+			"exclude_characters": schema.StringAttribute{
 				Optional: true,
 			},
 			"exclude_lowercase": schema.BoolAttribute{
@@ -94,7 +94,7 @@ func (e *ephemeralRandomPassword) Open(ctx context.Context, req ephemeral.OpenRe
 }
 
 type ephemeralRandomPasswordModel struct {
-	ExcludeCharacters       types.Bool   `tfsdk:"exclude_characters"`
+	ExcludeCharacters       types.String `tfsdk:"exclude_characters"`
 	ExcludeLowercase        types.Bool   `tfsdk:"exclude_lowercase"`
 	ExcludeNumbers          types.Bool   `tfsdk:"exclude_numbers"`
 	ExcludePunctuation      types.Bool   `tfsdk:"exclude_punctuation"`
diff --git a/internal/service/secretsmanager/random_password_ephemeral_test.go b/internal/service/secretsmanager/random_password_ephemeral_test.go
index d9fad50d8f8..b36f5259aa4 100644
--- a/internal/service/secretsmanager/random_password_ephemeral_test.go
+++ b/internal/service/secretsmanager/random_password_ephemeral_test.go
@@ -51,6 +51,12 @@ func testAccRandomPasswordEphemeralResourceConfig_basic() string {
 	return acctest.ConfigCompose(
 		acctest.ConfigWithEchoProvider("ephemeral.aws_secretsmanager_random_password.test"),
 		`
-ephemeral "aws_secretsmanager_random_password" "test" {}
+ephemeral "aws_secretsmanager_random_password" "test" {
+  password_length     = 40
+  exclude_characters  = "abc"
+  exclude_numbers     = true
+  exclude_uppercase   = true
+  exclude_punctuation = true
+}
 `)
 }