http://docs.puppetlabs.com/references/latest/type.html#file-attribute-mode : "When setting numeric permissions for directories, Puppet sets the search permission wherever the read permission is set."

I think 0640 is ok here.