ec2tags.rb

require 'facter'
require 'aws-sdk'

if Facter.value("ec2_instance_id") != nil
  instance_id = Facter.value("ec2_instance_id")
  region = Facter.value("ec2_placement_availability_zone")[0..-2]
  Facter.add("ec2_region") { setcode { region } }
  begin
    ec2 = Aws::EC2::Client.new(region:region)
    instance = ec2.describe_instances(instance_ids:[instance_id])
    tags = instance.reservations[0].instances[0].tags
  rescue Aws::EC2::Errors::ServiceError
    tags
  end
  tags.each do |tag|
    fact = "ec2_tag_#{tag["key"]}"
    Facter.add(fact) { setcode { tag["value"] } }
  end
end

You can replace lines 10 and 11 with: tags = ec2.describe_tags(filters: [{ name: "resource-id", values: [instance_id] }]).tags

This prevents the need for the ec2::DescribeInstance permission (you only need ec2::DescribeTags)