The `defined()` means of solving this problem would be to:

    if ! defined(Concat::Fragment['access_header']) {
      concat::fragment { 'access_header':
        target  => $access_conf,
        order   => 01,
        content => template('pam/header.erb'),
      }
    }

This would then create the resource the first time an instance of the defined type was created, but on subsequent defined type resource instances the `defined()` function would return true and the concat::fragment would not be re-created.

Alternatively, it could be turned into a virtual resource like the Concat resources themselves. I.e. in init.pp add

    @concat::fragment { 'access_header':
      target  => $access_conf,
      order   => 01,
      content => template('pam/header.erb'),
    }

And then here just use

    realize(Concat::Fragment['access_header'])

I would suggest doing the latter for now for consistency sake but then turn around and convert all three virtual resources to use the `defined()` pattern for clarity' sake in a follow-up pull request and remove the init.pp file (since it would then be unnecessary).