I think this will generate an `AND`, so you'd only pull back hosts that have both a puppet proxy and a puppet CA proxy set to this resource, when in fact you probably want OR.