You should use credential for this tenant for each resours, its truly for puppet resource