Vagrant + Puppet facter variable question

gistfile1.txt

Vagrantfile:
...
  config.vm.provision "puppet" do |puppet|
    puppet.module_path = "modules"
    puppet.facter = {
      'vpnUsername' => VPN_USERNAME,
      'vpnPassword' => VPN_PASSWORD
    }
    puppet.options = "--verbose --debug"
  end
...

Manifest:
...
exec { 'vpn connect':
  command => "echo ${vpnPassword} | /usr/sbin/openconnect vpn.domainname.com -u ${vpnUsername} --passwd-on-stdin -b --pid-file=/vpn.pid",
  path => '/bin',
  user => 'root',
  require => Package['network-manager-openconnect'],
}
...

*****
When I run "vagrant provision --debug" with the env vars set, I see the values coming in in the logs, but the exec command has the variables empty:

...
DEBUG ssh: Re-using SSH connection.
 INFO ssh: Execute: FACTER_vpnUsername='john.doe' FACTER_vpnPassword='password' puppet apply --verbose --debug --modulepath '/tmp/vagrant-puppet-3/modules-0:/etc/puppet/modules' --manifestdir /tmp/vagrant-puppet-3/manifests --detailed-exitcodes /tmp/vagrant-puppet-3/manifests/default.pp (sudo=true)
...
DEBUG ssh: stderr: Error: echo  | /usr/sbin/openconnect vpn.domainname.com -u  --passwd-on-stdin -b --pid-file=/vpn.pid returned 1 instead of one of [0]
...