diff --git a/tools/setup/bootstrap-aws-installer b/tools/setup/bootstrap-aws-installer
index e4d9fd7b80..46d206f0b5 100644
--- a/tools/setup/bootstrap-aws-installer
+++ b/tools/setup/bootstrap-aws-installer
@@ -3,7 +3,7 @@
 # Prepended to this automatically are the following:
 #SERVER=
 #HOSTNAME=
-#ROLES=
+#FULL_ROLES=
 #REPO_URL=
 #BRANCH=
 #SSH_SECRET_ID=
@@ -82,9 +82,9 @@ git clone "$REPO_URL" zulip -b "$BRANCH"
 git -C zulip checkout "$BRANCH"
 
 (
-    VIRTUALENV_NEEDED=$(if echo "$ROLES" | grep -q app_frontend; then echo -n yes; else echo -n no; fi)
+    VIRTUALENV_NEEDED=$(if echo "$FULL_ROLES" | grep -q app_frontend; then echo -n yes; else echo -n no; fi)
     export VIRTUALENV_NEEDED
-    export PUPPET_CLASSES="$ROLES"
+    export PUPPET_CLASSES="$FULL_ROLES"
     export APT_OPTIONS="-o Dpkg::Options::=--force-confnew"
     /root/zulip/scripts/setup/install \
         --self-signed-cert \
diff --git a/tools/setup/install-aws-server b/tools/setup/install-aws-server
index 6176ec8d67..fb7f078c9b 100755
--- a/tools/setup/install-aws-server
+++ b/tools/setup/install-aws-server
@@ -11,8 +11,9 @@ if [ -z "$SERVER" ] || [ -z "$ROLES" ]; then
     echo "Installs an empty Ubuntu server in AWS with a Zulip server role."
     echo
     echo " * server is the local part of the hostname (e.g. postgres0)"
-    echo " * roles is a comma-separated list of Puppet rules to be passed to scripts/lib/install"
-    echo "   E.g. 'zulip::profile::postgresql'"
+    echo " * roles is a comma-separated list of Puppet profile names; these"
+    echo "   will get 'zulip_ops::profile::' prepended to them, and passed"
+    echo "   to scripts/lib/install -- e.g. 'postgresql'"
     echo " * branch is used to override the default branch to install from."
     echo
     echo "Reads configuration from $HOME/.zulip-install-server.conf, which should look like:"
@@ -45,6 +46,14 @@ if [ -z "$BRANCH" ]; then
     BRANCH=$(crudini --get "$zulip_install_config_file" repo default_branch)
 fi
 
+for role in ${ROLES//,/ }; do
+    if ! [ -f "../../puppet/zulip_ops/manifests/profile/$role.pp" ]; then
+        echo "No such role zulip_ops::profile::$role !"
+        exit 1
+    fi
+done
+FULL_ROLES=$(echo "$ROLES" | perl -pe '$_=join(",",map{"zulip_ops::profile::$_"} split ",")')
+
 function lookup() {
     KEY="$1"
     crudini --get "$zulip_install_config_file" "aws-$ROLES" "$KEY" 2>/dev/null \
@@ -90,14 +99,14 @@ BOOTDATA=$(mktemp)
     echo "#!/bin/bash"
     echo "SERVER=$SERVER"
     echo "HOSTNAME=$HOSTNAME"
-    echo "ROLES=$ROLES"
+    echo "FULL_ROLES=$FULL_ROLES"
     echo "REPO_URL=$REPO_URL"
     echo "BRANCH=$BRANCH"
     echo "SSH_SECRET_ID=$SSH_SECRET_ID"
     sed '/^AWS=/ r ./bootstrap-awscli.sh' bootstrap-aws-installer
 } >>"$BOOTDATA"
 
-TAG_ROLE_NAMES=$(echo "$ROLES" | perl -pe 's/\w+::profile::(\w+)/$1/g')
+TAG_ROLE_NAMES="$ROLES"
 TAGS="[{Key=Name,Value=$SERVER},{Key=role,Value=\"$TAG_ROLE_NAMES\"}]"
 INSTANCE_DATA=$($AWS ec2 run-instances \
     --tag-specifications "ResourceType=instance,Tags=$TAGS" \