diff --git a/lib/puppet/provider/rabbitmq_user/rabbitmqctl.rb b/lib/puppet/provider/rabbitmq_user/rabbitmqctl.rb
index 7062cf398..b1e2b575b 100644
--- a/lib/puppet/provider/rabbitmq_user/rabbitmqctl.rb
+++ b/lib/puppet/provider/rabbitmq_user/rabbitmqctl.rb
@@ -45,6 +45,10 @@ def exists?
   end
 
   def create
+    # Fail here (rather than a validate block in the type) if password is not
+    # set, so that "puppet resource" still works.
+    raise Puppet::Error, "Password is a required parameter for rabbitmq_user (user: #{name})" if @resource[:password].nil?
+
     rabbitmqctl('add_user', @resource[:name], @resource[:password])
 
     tags = @resource[:tags]
diff --git a/lib/puppet/type/rabbitmq_user.rb b/lib/puppet/type/rabbitmq_user.rb
index 6a76ff62a..9fda2c29d 100644
--- a/lib/puppet/type/rabbitmq_user.rb
+++ b/lib/puppet/type/rabbitmq_user.rb
@@ -79,10 +79,4 @@ def should_to_s(value)
       Array(value)
     end
   end
-
-  validate do
-    if self[:ensure] == :present && !self[:password]
-      raise ArgumentError, 'must set password when creating user' unless self[:password]
-    end
-  end
 end
diff --git a/spec/unit/puppet/provider/rabbitmq_user/rabbitmqctl_spec.rb b/spec/unit/puppet/provider/rabbitmq_user/rabbitmqctl_spec.rb
index b4d968dbb..0fd7d9c85 100644
--- a/spec/unit/puppet/provider/rabbitmq_user/rabbitmqctl_spec.rb
+++ b/spec/unit/puppet/provider/rabbitmq_user/rabbitmqctl_spec.rb
@@ -40,6 +40,20 @@
       provider.expects(:rabbitmqctl).with('add_user', 'rmq_x', 'secret')
       provider.create
     end
+    context 'no password supplied' do
+      let(:resource) do
+        Puppet::Type.type(:rabbitmq_user).new(
+          ensure: :present,
+          name: 'rmq_x'
+        )
+      end
+
+      it 'raises an error' do
+        expect do
+          provider.create
+        end.to raise_error(Puppet::Error, 'Password is a required parameter for rabbitmq_user (user: rmq_x)')
+      end
+    end
   end
 
   describe '#destroy' do