This document outlines how to use Puppet to configure an EC2 instance launched from a user-data script in AWS, storing modules and data in Git and S3 while keeping secrets in S3, allowing any version of code to be deployed to a scalable infrastructure without manual server approval where Puppet only runs once at instance launch.

1. Masterless Puppet
in AWS
by Daniel Thornton (relud)

2. AWS Resources
EC2 instance
EC2 user-data
IAM role
S3 bucket

3. Other Resources
Github
Puppet Forge
Hiera

4. Git Repo
Modules and non-secret hiera data
Installed to /etc/puppet
List forge modules in hiera

5. Secrets
Stored in S3 bucket
IAM role for access

6. Deployment
Write userdata
Assign role with Facter external fact
Launch EC2 instance with userdata

7. Live Demo
https://github.com/relud/puppet-demo

8. Improvements
● Bundle /etc/puppet (except secrets)
● Store secrets in git and automatically sync

9. Pros
● Deploy any code version
● Simple puppet forge integration
● Scalable
● No manual approval of servers
● Puppet only runs once

10. Cons
● Puppet only runs once
● Puppetdb and dashboards (like
TheForeman) don’t work well
● Doesn’t translate well outside AWS

11. Questions?