diff --git a/manifests/init.pp b/manifests/init.pp
index a6f27d0a..4c87968c 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -151,6 +151,11 @@
 #   default region name that heat talks to service endpoints on.
 #   Defaults to undef
 #
+# [*instance_user*]
+#   (Optional) The default user for new instances. Although heat claims that
+#   this feature is deprecated, it still sets the users to ec2-user if
+#   you leave this unset. This will likely be deprecated in K or L.
+#
 # === Deprecated Parameters
 #
 # [*mysql_module*]
@@ -220,6 +225,7 @@ class heat(
   $keystone_host               = '127.0.0.1',
   $keystone_port               = '35357',
   $keystone_protocol           = 'http',
+  $instance_user               = undef,
 ) {
 
   include heat::params
@@ -523,4 +529,13 @@ class heat(
   } else {
     heat_config { 'DEFAULT/region_name_for_services': ensure => absent; }
   }
+
+  # instance_user
+  if $instance_user {
+    heat_config { 'DEFAULT/instance_user': value => $instance_user; }
+  } else {
+    heat_config { 'DEFAULT/instance_user': ensure => absent; }
+  }
+
+
 }
diff --git a/spec/classes/heat_init_spec.rb b/spec/classes/heat_init_spec.rb
index 944e7748..0d6a2090 100644
--- a/spec/classes/heat_init_spec.rb
+++ b/spec/classes/heat_init_spec.rb
@@ -450,6 +450,24 @@ describe 'heat' do
     end
   end
 
+  shared_examples_for 'with instance_user set' do
+    before do
+      params.merge!(
+        :instance_user => "fred",
+      )
+    end
+
+    it 'has instance_user set when specified' do
+      should contain_heat_config('DEFAULT/instance_user').with_value('fred')
+    end
+  end
+
+  shared_examples_for 'without instance_user set' do
+    it 'doesnt have instance_user set by default' do
+      should contain_heat_config('DEFAULT/instance_user').with_enure('absent')
+    end
+  end
+
   context 'on Debian platforms' do
     let :facts do
       { :osfamily => 'Debian' }