You need to be able to set these on create.

This won't protect you when you try to change an existing one, but
that's not easy to do within puppet.