# uname -a
Linux base 4.0.5-gentoo #1 SMP Wed Jul 1 02:23:16 JST 2015 x86_64 Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz GenuineIntel GNU/Linux# emerge -pvq openldap openssh sssd sudo
[ebuild R ] net-nds/openldap-2.4.38-r2 USE="berkdb crypt gnutls ipv6 minimal sasl ssl syslog tcpd -cxx -debug -experimental -icu -iodbc -kerberos -odbc -overlays -perl -samba (-selinux) -slp -smbkrb5passwd" ABI_X86="(64) -32 (-x32)" 
The first part - ChangeRequest is a generic plan that holds on to a set of values of type T (given when plan is instantiated), and emits the changed set whenever it changes.
type AddRemove = Enum['add', 'remove']
type ChangeRequest[T] = Struct[{'kind' => AddRemove, 'value' => T }]
The pe-easy-agent.sh script mentioned in the instance_defaults hash is available at pe-easy-agent.sh
I feel your pain. SSL is tough and is probably the number one stumbling block for new users getting Puppet working in their environment. Hopefully this answer helps reduce frustration and get you up and running. The good news is, once it's set up right, you won't have to fiddle with it any more.
First, make sure the problem you're having is actually an SSL problem. Almost all of the SSL-related error messages on the client start with the string SSL_connect and then the error raised up by the underlying crypto libraries. General networking errors will not have this string, so normal network troubleshooting methodology applies; specifically, Connection refused - connect(2) means a TCP connection attempt got a RST packet indicating a firewall or puppet master not running, and getaddrinfo: nodename nor servname provided, or not known means the server's hostname (the value of puppet agent --configprint server) was not resolvable in DNS/hosts.
Next, assuming you do have an SSL_connect style error, it
| # Generates facts of the version pkg_foo => 'version' | |
| begin | |
| require 'puppet' | |
| pkgs = Puppet::Type.type(:package).instances | |
| pkgs.each do |pkg| | |
| Facter.add("pkg_#{pkg[:name]}") do | |
| value = pkg.provider.properties[:ensure] | |
| if value != :absent |
| ## Launching an instance in EC2 | |
| └(~)▷ irb | |
| >> require 'puppet/face' | |
| => true | |
| >> arguments = { 'image' => 'ami-1bd68a5e', 'keyname' => 'gary_test', 'type' => 't1.micro', 'region' => 'us-west-1' } | |
| => {"region"=>"us-west-1", "keyname"=>"gary_test", "type"=>"t1.micro", "image"=>"ami-1bd68a5e"} | |
| >> ec2_ip = Puppet::Face[:node_aws, :current].create(arguments) | |
| ####################### | |
| => "ec2-184-72-21-49.us-west-1.compute.amazonaws.com" |
