Correct. I was working off of tag v0.0.5, where these permissions were the default: https://github.com/jfryman/puppet-nginx/blob/v0.0.5/manifests/resource/vhost.pp

Will update.