Perhaps this should be before encrypted_data_bag?