diff --git a/builder/oracle/bmcs/config.go b/builder/oracle/bmcs/config.go
index 8f975d5c5..944906033 100644
--- a/builder/oracle/bmcs/config.go
+++ b/builder/oracle/bmcs/config.go
@@ -37,6 +37,7 @@ type Config struct {
 	Region      string `mapstructure:"region"`
 	Fingerprint string `mapstructure:"fingerprint"`
 	KeyFile     string `mapstructure:"key_file"`
+	PassPhrase  string `mapstructure:"pass_phrase"`
 
 	AvailabilityDomain string `mapstructure:"availability_domain"`
 	CompartmentID      string `mapstructure:"compartment_ocid"`
@@ -114,6 +115,10 @@ func NewConfig(raws ...interface{}) (*Config, error) {
 		accessCfg.Fingerprint = c.Fingerprint
 	}
 
+	if c.PassPhrase != "" {
+		accessCfg.PassPhrase = c.PassPhrase
+	}
+
 	if c.KeyFile != "" {
 		accessCfg.KeyFile = c.KeyFile
 		accessCfg.Key, err = client.LoadPrivateKey(accessCfg)
diff --git a/website/source/docs/builders/oracle-bmcs.html.md b/website/source/docs/builders/oracle-bmcs.html.md
index b8cfffdc7..a4c45d776 100644
--- a/website/source/docs/builders/oracle-bmcs.html.md
+++ b/website/source/docs/builders/oracle-bmcs.html.md
@@ -85,6 +85,11 @@ builder.
     [BMCS config file](https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/sdkconfig.htm)
     if present.
 
+ -  `pass_phrase` (string) - Pass phrase used to decrypt the private key used
+    to sign requests to the BMCS API. Overrides value provided by the
+    [BMCS config file](https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/sdkconfig.htm)
+    if present.
+
  -  `region` (string) - An Oracle Bare Metal Cloud Services region. Overrides
     value provided by the
     [BMCS config file](https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/sdkconfig.htm)