diff --git a/README.md b/README.md
index 6e67eef86..e6fd4efe1 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ scenario](#all-in-one).
 | designate  |             |             |     bind    |              |
 | backup     |             |    swift    |             |              |
 | gnocchi    |     rbd     |             |             |              |
+| ec2api     |             |       X     |             |              |
 | heat       |             |             |       X     |              |
 | swift      |             |       X     |             |              |
 | sahara     |             |             |       X     |              |
diff --git a/fixtures/scenario002.pp b/fixtures/scenario002.pp
index d4261370b..162660f0d 100644
--- a/fixtures/scenario002.pp
+++ b/fixtures/scenario002.pp
@@ -22,11 +22,14 @@ case $::osfamily {
     # we'll start testing barbican after Newton stable, Ubuntu packaging is not
     # updated enough.
     $barbican_enabled = false
+    # ec2api is not packaged on Ubuntu Trusty
+    $ec2api_enabled   = false
   }
   'RedHat': {
     $ipv6               = true
     $zaqar_enabled      = true
     $barbican_enabled   = true
+    $ec2api_enabled     = true
   }
   default: {
     fail("Unsupported osfamily (${::osfamily})")
@@ -73,6 +76,10 @@ if $barbican_enabled {
   include ::openstack_integration::barbican
 }
 
+if $ec2api_enabled {
+  include ::openstack_integration::ec2api
+}
+
 class { '::openstack_integration::tempest':
   cinder                  => true,
   cinder_backup           => true,
@@ -80,4 +87,5 @@ class { '::openstack_integration::tempest':
   ironic                  => true,
   zaqar                   => $zaqar_enabled,
   attach_encrypted_volume => $barbican_enabled,
+  ec2api                  => $ec2api_enabled,
 }
diff --git a/manifests/ec2api.pp b/manifests/ec2api.pp
new file mode 100644
index 000000000..07fe26e84
--- /dev/null
+++ b/manifests/ec2api.pp
@@ -0,0 +1,43 @@
+# Configure the ec2api service
+#
+class openstack_integration::ec2api {
+
+  include ::openstack_integration::config
+  include ::openstack_integration::params
+
+  # Ec2api resources
+  class { '::ec2api::logging':
+    debug => true,
+  }
+  class { '::ec2api::keystone::auth':
+    public_url   => "${::openstack_integration::config::base_url}:8788",
+    internal_url => "${::openstack_integration::config::base_url}:8788",
+    admin_url    => "${::openstack_integration::config::base_url}:8788",
+    password     => 'a_big_secret',
+  }
+  class { '::ec2api::db::mysql':
+    password => 'ec2api',
+  }
+  class { '::ec2api::db::sync': }
+  case $::osfamily {
+    'RedHat': {
+      class { '::ec2api::db':
+        database_connection => 'mysql+pymysql://ec2api:ec2api@127.0.0.1/ec2api?charset=utf8',
+      }
+      class { '::ec2api': }
+      class { '::ec2api::keystone::authtoken':
+        password => 'a_big_secret',
+        auth_url => $::openstack_integration::config::keystone_admin_uri,
+        auth_uri => $::openstack_integration::config::keystone_auth_uri,
+      }
+      class { '::ec2api::api':
+        keystone_ec2_tokens_url => "${::openstack_integration::config::keystone_auth_uri}/v3/ec2tokens",
+        external_network        => 'public',
+      }
+      include ::ec2api::metadata
+    }
+    default: {
+      fail("Unsupported osfamily (${::osfamily})")
+    }
+  }
+}
diff --git a/manifests/tempest.pp b/manifests/tempest.pp
index e16a33a43..03ab0349f 100644
--- a/manifests/tempest.pp
+++ b/manifests/tempest.pp
@@ -20,6 +20,10 @@
 #   (optional) Define if Designate needs to be tested.
 #   Default to false.
 #
+# [*ec2api*]
+#   (optional) Define if EC2-API needs to be tested.
+#   Default to false.
+#
 # [*glance*]
 #   (optional) Define if Glance needs to be tested.
 #   Default to true.
@@ -78,6 +82,7 @@ class openstack_integration::tempest (
   $cinder                  = false,
   $cinder_backup           = false,
   $designate               = false,
+  $ec2api                  = false,
   $glance                  = true,
   $gnocchi                 = false,
   $heat                    = false,
@@ -144,6 +149,7 @@ class openstack_integration::tempest (
     zaqar_available         => $zaqar,
     mistral_available       => $mistral,
     gnocchi_available       => $gnocchi,
+    ec2api_available        => $ec2api,
     public_network_name     => 'public',
     dashboard_url           => $::openstack_integration::config::base_url,
     flavor_ref              => '42',
diff --git a/run_tests.sh b/run_tests.sh
index 5a59a04fc..67364cf88 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -204,6 +204,12 @@ echo "api.baremetal.admin.test_drivers" >> /tmp/openstack/tempest/test-whitelist
 # Zaqar
 echo "v2.test_queues.TestManageQueue" >> /tmp/openstack/tempest/test-whitelist.txt
 
+# ec2api
+# Note: VPN tests require VPNaaS, which doesn't work yet in puppet-tempest. As
+# soon as enabling neutron_vpnaas_available works there, the VPN tests can be
+# included.
+echo "ec2api.tests.functional((?!_vpn_).)*$" >> /tmp/openstack/tempest/test-whitelist.txt
+
 # Cinder Backup
 echo "VolumesBackupsAdminV2Test" >> /tmp/openstack/tempest/test-whitelist.txt