From the top of my head, I think this works because we set the `user` environment variable to `ubuntu`, but I'm not sure if that goes and then works out that it needs to use the pass hash from the deployment script. After Puppet has successfully run at least once (which is within 30mins of the box being brought up, at most), these credentials will no longer work as the user is dropped.