Puppet eYAML to File - puppet

Question

I have a file that I've encrypted using hiera-eyaml and included in my configuration as such:
mymodule::config_file: ENC[PKCS7,...]
Now I'm trying to write the contents of the decoded string into a file as such:
class mymodule (
String $config_file
) {
file { '/etc/agent_config.json':
content => $config_file,
mode => '0644',
}
}
I would expect the output file to be the decrypted string, but instead I'm getting the encrypted eYAML instead.
Is what I'm doing not possible to do in puppet?
Edit:
The file looks correct when running eyaml edit
ex:
itglue::fireeye::fireeye_config: DEC(1)::PKCS7[{
"serverlist": {
"servers": [
...
]
}
}]!
Edit 2:
Our hiera.yaml is as such:
---
:backends:
- yaml
- eyaml
:yaml:
:datadir: /etc/puppet/hiera/hieradata
:eyaml:
:datadir: /etc/puppet/hiera/hieradata
:pkcs7_private_key: /var/lib/puppet/keys/private_key.pkcs7.pem
:pkcs7_public_key: /var/lib/puppet/keys/public_key.pkcs7.pem
:hierarchy:
- secure
- "%{::clientcert}"
- "node_role/%{::node_role}"
- "env/%{::environment}"
- "node_types/%{nodetype}"
- global
:logger: console

Answer 1

I don't have a system with hiera version 3 to test this on so it's a complete stab in the dark, but try swapping the ordering of the backends so
:backends:
- yaml
- eyaml
becomes
:backends:
- eyaml
- yaml
If that doesn't work I'd suggest storing your secrets data in a different location so have
/etc/puppet/hiera/hieradata
for your yaml and
/etc/puppet/hiera/hierasecretdata
for the secrets, that way the yaml search will never be looking in the eyaml file where it can find a key match.