This gist is based off of the work done by mrzarquan here https://github.com/mrzarquon/mrzarquon-certsigner/blob/master/templates/autosign-iam.rb.erb Modified to use the aws-sdk-core gem to increase flexibility of retrieving additional tags to inject into csr.

ec2_autosign.rb

#!/opt/puppetlabs/puppet/bin/ruby

# Andrew Popp
# ServiceChannel.com
# Auto Cert Signing executable for Policy based cert signing. Utilizes the aws-sdk and puppet components. 
# v1.0

require 'rubygems'
require 'aws-sdk-core'
require 'puppet'

certname = ARGV.pop
node = []
tag = {}
fqdn = ".domainname.com"

csr = Puppet::SSL::CertificateRequest.from_s(STDIN.read)
pp_instance_id = csr.request_extensions.find { |a| a['oid'] == '1.3.6.1.4.1.34380.1.1.2' }
instance_id = pp_instance_id['value']

retcode = 0

ec2  = Aws::EC2::Client.new(region: 'us-east-1')
node = ec2.describe_instances(instance_ids: [instance_id])
node.reservations[0].instances[0].tags.each do |tags|
  tag[tags.key] = tags.value
end
cname = tag["Name"]

if csr.name != certname
  retcode = 1
  elseif certname != cname+fqdn
  retcode = 2
elsif node.reservations[0].instances[0].state.name != "running" # How to retrieve the state of a node.
  retcode = 3
end

exit retcode