You can use a require => Exec[]
and daisy chain the exec
to require the config change(s).
If the Exec fails (exit status != 0) the subsequent tasks that require it should fail as well. I do something similar to execute ssh-keygen then set special permissions on .ssh when creating new users.
Example:
# Ensure the .ssh directory exists for each user
file { "${dot_ssh_dir}":
ensure => directory,
owner => $title,
mode => 700,
require => File["${home_dir}"],
}
# Run ssh-keygen (ONLY if id_rsa doesn't exist)
exec { "${title} ssh-keygen":
command => "ssh-keygen -f ./id_rsa -q -N ''",
cwd => $dot_ssh_dir,
user => $title,
creates => "${keyfile_private}",
path => ['/usr/bin', '/usr/sbin/', '/usr/local/sbin'],
require => File[$dot_ssh_dir],
}
# AuthorizedKeys should be 600
file { "${authorized_keys}":
source => "${keyfile_public}",
ensure => present,
mode => 600,
owner => $title,
group => 'sftpusers',
require => Exec["${title} ssh-keygen"],
}