Forge Home


AWS EC2 tags exported as puppet facts and AWS cli tool installed.


1,175,186 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.3.0 (latest)
  • 0.2.0
  • 0.1.20
  • 0.1.18
  • 0.1.17
  • 0.1.16
  • 0.1.15
  • 0.1.14
  • 0.1.13
  • 0.1.12 (deleted)
  • 0.1.11
  • 0.1.10
  • 0.1.9 (deleted)
  • 0.1.8 (deleted)
  • 0.1.7 (deleted)
  • 0.1.6 (deleted)
  • 0.1.5 (deleted)
  • 0.1.3 (deleted)
  • 0.1.2 (deleted)
  • 0.1.1 (deleted)
  • 0.1.0 (deleted)
released Sep 28th 2018
This version is compatible with:
  • Puppet Enterprise 2023.7.x, 2023.6.x, 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x, 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >=3.8.0 < 2016.4.0
  • , , , , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'bryana-ec2tagfacts', '0.3.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add bryana-ec2tagfacts
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install bryana-ec2tagfacts --version 0.3.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



bryana/ec2tagfacts — version 0.3.0 Sep 28th 2018


Build Status Puppet Forge Downloads Code Climate

Table of Contents

  1. Overview
  2. Setup - The basics of getting started with ec2tagfacts
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. RSpec Testing - Automated QA tests
  6. Change Log
  7. Limitations - OS compatibility, etc.


This turns EC2 instance tags into puppet facts. For example: $::ec2_tag_tagname and structured as $::ec2_tags['tagname'].


What ec2tagfacts affects

  • Tag names are prepended with ec2_tag_, converted to all lowercase, and non-word character are converted to underscores.
  • Tags are also available as a structured fact called ec2_tags
  • You can now use EC2 tags in puppet classes, for example $::ec2_tag_name or $::ec2_tags['name'].
  • EC2 tags are then added to facter.
  • Python pip is installed in order to install the aws cli tool with pip if pip is the provider for your platform. For example CentOS7 epel provides awscli so that us used.
  • The AWS cli python package is installed.
  • Optionally provided AWS credentials are set in the /root/.aws/credentials INI file. Role access method is preferred.
  • EPEL is required for RHEL based systems and is automatically setup on them unless you disable that feature.

Setup Requirements

The most secure and preferred method is to use IAM Roles. This allows the AWS cli tool to read EC2 tags without exposing a key+secret on the filesystem. If this is a new instance you are just now launching I recommend using an IAM Role. If this is an existing system you can not assign IAM Roles to launched EC2 instances so you will need to use an IAM key+secret pair. AWS credentials with read access to EC2 tags are optional parameters or from hiera or class parameters. EPEL is required for RHEL based systems for python-pip package support and is automatically setup when that OS family is detected.


This is the most secure and preferred method.

Console -> Identity & Access Management -> Roles -> Create New Role -> Role Name Example: WebServer1 -> Select Amazon EC2 -> Next Step -> Create Role -> Edit Role created -> Inline Policy / Create Role Policy -> Custom Policy -> Policy Name Example: ec2tagread -> Policy Document ->

    "Version": "2012-10-17",
    "Statement": [
            "Effect": "Allow",
            "Action": [
            "Resource": "*"

-> Apply Policy

Now when you launch EC2 instances make sure you select this Role to launch them into. Once launched an EC2 instance can't be added to a role or removed from a role but the contents of the roles' policies can be changed at any time.

AWS IAM Policy

This is the option available to existing EC2 instance without Role assignments. The AWS access_key you use must be given rights to read ec2 tags. Here is an example of a small read-only ec2 tag policy. This is a less secure alternative because the secret+key are exposed on the filesystem. However the AWS cli ini file is owned by root and only readable by root.

   "Version": "2012-10-17",
   "Statement": [{
      "Effect": "Allow",
      "Action": [
      "Resource": "*"

R10k Example

Add this to your Puppetfile:

mod 'bryana/ec2tagfacts', :latest
mod 'puppetlabs-stdlib', :latest
mod 'stahnma/epel', :latest
mod 'puppetlabs/inifile', :latest


Class with parameters

Role Method

class { '::ec2tagfacts': }

Access Key Method

class { '::ec2tagfacts':
  aws_access_key_id      => 'ASJSF34782SJGU',
  aws_secret_access_key  => 'SJG34861gaKHKaDfjq29gfASf427RGHSgesge',

Hiera Example

This is only needed on instances without a Role providing the tag read rights. The Role method should be used whenever possible.

ec2tagfacts::aws_access_key_id: 'ASJSF34782SJGU'
ec2tagfacts::aws_secret_access_key: 'SJG34861gaKHKaDfjq29gfASf427RGHSgesge'

Then include the class like this:

include ec2tagfacts



####Public classes

  • ec2tagfacts: Installs and configures aws cli and loads EC2 tags as facts in facter.

####Private classes

  • ec2tagfacts::params: Auto detection of package names based on OS family.



Optional. Specify the AWS access_key_id with read rights to EC2 tags.


Optional. Specify the AWS access_key_id's secret.


Optional. Change the location of the AWS cli credential ini file. Full path expected.


Optional. True/false. Autodetected in ec2tagfacts::params based on OS family. You can override that with the parameter or in hiera.


Optional. String/false. Autodetected in ec2tagfacts::params based on OS family. You can override that with the parameter or in hiera. This is the python-pip package name to install. False disables installation. Python pip is used to install awscli which is required.


Optional. String. Autodetected in ec2tagfacts::params based on OS family. You can override that with the parameter or in hiera. This is the awscli package provider to use. Python pip is used to install awscli unless a platform package is available.


Optional. String. Autodetected in ec2tagfacts::params based on OS family. You can override that with the parameter or in hiera. This is the Ruby JSON package name to use. To disable management of this package, set to false.

RSpec Testing

If bundle isn't already installed it is generally installed with gem install bundle.

bundle install
rake spec

TravisCI is currently testing 25 ruby+puppet environments on 49 OS flavor+parameter combinations. This is 1,225 tests per QA cycle.

OS Support

  • RedHat 5
  • RedHat 6
  • RedHat 7
  • CentOS 5
  • CentOS 6
  • CentOS 7
  • Debian 6
  • Debian 7
  • Debian 8
  • OracleLinux 6
  • OracleLinux 7
  • Scientific Linux 5
  • Scientific Linux 6
  • Scientific Linux 7
  • SLES 10
  • SLES 11
  • SLES 12
  • Ubuntu 10
  • Ubuntu 12
  • Ubuntu 14
  • Ubuntu 15
  • Ubuntu 16
  • Gentoo - experimental
  • Amazon Linux 2014 - rspec nodeset not available for automated testing
  • Amazon Linux 2015 - rspec nodeset not available for automated testing
  • Amazon Linux 2016 - rspec nodeset not available for automated testing however this is the development reference platform

Change Log

  • v0.2.0 - Added structured facts. Better support on platforms for using pip package or platform package.
  • v0.1.x - Initial release


This is written for both CentOS/RHEL/Amazon based systems and Debian/Ubuntu based systems. EPEL is required for the RHEL family in order to obtain the python-pip package to install the AWS cli pip package and is automatically detected and setup.