diff --git a/builtin/providers/aws/import_aws_network_acl_test.go b/builtin/providers/aws/import_aws_network_acl_test.go
index 407d3e45e..6adf8a47d 100644
--- a/builtin/providers/aws/import_aws_network_acl_test.go
+++ b/builtin/providers/aws/import_aws_network_acl_test.go
@@ -23,11 +23,11 @@ func TestAccAWSNetworkAcl_importBasic(t *testing.T) {
 		Providers:    testAccProviders,
 		CheckDestroy: testAccCheckAWSNetworkAclDestroy,
 		Steps: []resource.TestStep{
-			resource.TestStep{
+			{
 				Config: testAccAWSNetworkAclEgressNIngressConfig,
 			},
 
-			resource.TestStep{
+			{
 				ResourceName:      "aws_network_acl.bar",
 				ImportState:       true,
 				ImportStateVerify: true,
diff --git a/builtin/providers/aws/resource_aws_network_acl.go b/builtin/providers/aws/resource_aws_network_acl.go
index cd3c6d049..7a525e299 100644
--- a/builtin/providers/aws/resource_aws_network_acl.go
+++ b/builtin/providers/aws/resource_aws_network_acl.go
@@ -397,7 +397,7 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, conn *ec2
 				}
 			}
 
-			if add.CidrBlock != nil {
+			if add.CidrBlock != nil && *add.CidrBlock != "" {
 				// AWS mutates the CIDR block into a network implied by the IP and
 				// mask provided. This results in hashing inconsistencies between
 				// the local config file and the state returned by the API. Error
@@ -417,11 +417,11 @@ func updateNetworkAclEntries(d *schema.ResourceData, entryType string, conn *ec2
 				IcmpTypeCode: add.IcmpTypeCode,
 			}
 
-			if add.CidrBlock != nil {
+			if add.CidrBlock != nil && *add.CidrBlock != "" {
 				createOpts.CidrBlock = add.CidrBlock
 			}
 
-			if add.Ipv6CidrBlock != nil {
+			if add.Ipv6CidrBlock != nil && *add.Ipv6CidrBlock != "" {
 				createOpts.Ipv6CidrBlock = add.Ipv6CidrBlock
 			}