I'm thinking it should be fairly simple to have a puppetmaster call
out to an ENC script that queries the EC2 API to get tags for
classification purposes, and would be surprised if someone hasn't
already written an ENC script to do this.
I'm thinking this will help let nodes in autoscaling groups get
classified, however that does still leave the issue of certs.