diff --git a/lib/puppet/provider/murano_cfapi_config/ini_setting.rb b/lib/puppet/provider/murano_cfapi_config/ini_setting.rb
new file mode 100644
index 0000000..86b0b29
--- /dev/null
+++ b/lib/puppet/provider/murano_cfapi_config/ini_setting.rb
@@ -0,0 +1,10 @@
+Puppet::Type.type(:murano_cfapi_config).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
+) do
+
+  def self.file_path
+    '/etc/murano/murano-cfapi.conf'
+  end
+
+end
diff --git a/lib/puppet/provider/murano_cfapi_paste_ini_config/ini_setting.rb b/lib/puppet/provider/murano_cfapi_paste_ini_config/ini_setting.rb
new file mode 100644
index 0000000..bd51608
--- /dev/null
+++ b/lib/puppet/provider/murano_cfapi_paste_ini_config/ini_setting.rb
@@ -0,0 +1,10 @@
+Puppet::Type.type(:murano_cfapi_paste_ini_config).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
+) do
+
+  def self.file_path
+    '/etc/murano/murano-cfapi-paste.ini'
+  end
+
+end
diff --git a/lib/puppet/type/murano_cfapi_config.rb b/lib/puppet/type/murano_cfapi_config.rb
new file mode 100644
index 0000000..22475c8
--- /dev/null
+++ b/lib/puppet/type/murano_cfapi_config.rb
@@ -0,0 +1,51 @@
+Puppet::Type.newtype(:murano_cfapi_config) do
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from murano-cfapi.conf'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+    newvalues(/^[\S ]*$/)
+
+    def is_to_s(currentvalue)
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s(newvalue)
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs.  Defaults to `false`.'
+
+    newvalues(:true, :false)
+
+    defaultto false
+  end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  autorequire(:package) do
+    'murano-common'
+  end
+end
diff --git a/lib/puppet/type/murano_cfapi_paste_ini_config.rb b/lib/puppet/type/murano_cfapi_paste_ini_config.rb
new file mode 100644
index 0000000..7ae2f6b
--- /dev/null
+++ b/lib/puppet/type/murano_cfapi_paste_ini_config.rb
@@ -0,0 +1,51 @@
+Puppet::Type.newtype(:murano_cfapi_paste_ini_config) do
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from murano-cfapi-paste.ini'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+    newvalues(/^[\S ]*$/)
+
+    def is_to_s(currentvalue)
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s(newvalue)
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs.  Defaults to `false`.'
+
+    newvalues(:true, :false)
+
+    defaultto false
+  end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  autorequire(:package) do
+    'murano-common'
+  end
+end
diff --git a/manifests/cfapi.pp b/manifests/cfapi.pp
index 1f7a155..fd603e1 100644
--- a/manifests/cfapi.pp
+++ b/manifests/cfapi.pp
@@ -44,7 +44,7 @@ class murano::cfapi(
   include ::murano::params
   include ::murano::policy
 
-  Murano_config<||> ~> Service['murano-cfapi']
+  Murano_cfapi_config<||> ~> Service['murano-cfapi']
   Class['murano::policy'] -> Service['murano-cfapi']
 
   if $manage_service {
@@ -55,7 +55,7 @@ class murano::cfapi(
     }
   }
 
-  murano_config {
+  murano_cfapi_config {
     'cfapi/tenant':    value => $tenant;
     'cfapi/bind_host': value => $bind_host;
     'cfapi/bind_port': value => $bind_port;
@@ -77,5 +77,5 @@ class murano::cfapi(
   }
 
   Package['murano-cfapi'] ~> Service['murano-cfapi']
-  Murano_paste_ini_config<||> ~> Service['murano-cfapi']
+  Murano_cfapi_paste_ini_config<||> ~> Service['murano-cfapi']
 }
diff --git a/manifests/config.pp b/manifests/config.pp
index d2b1c70..901d83c 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -17,14 +17,32 @@
 #     DEFAULT/bar:
 #       value: barValue
 #
+# [*murano_cfapi_config*]
+#   (optional) Allow configuration of CFAPI Murano service
+#
+# [*murano_paste_config*]
+#   (optional) Allow configuration of arbitrary murano paste configurations.
+#
+# [*murano_cfapi_paste_config*]
+#   (optional) Allow configuration of CFAPI Murano paste configurations.
+#
 #   NOTE: The configuration MUST NOT be already handled by this module
 #   or Puppet catalog compilation will fail with duplicate resources.
 #
 class murano::config (
-  $murano_config        = {},
+  $murano_config             = {},
+  $murano_cfapi_config       = {},
+  $murano_paste_config       = {},
+  $murano_cfapi_paste_config = {}
 ) {
 
   validate_hash($murano_config)
+  validate_hash($murano_cfapi_config)
+  validate_hash($murano_paste_config)
+  validate_hash($murano_cfapi_paste_config)
 
   create_resources('murano_config', $murano_config)
+  create_resources('murano_cfapi_config', $murano_cfapi_config)
+  create_resources('murano_paste_ini_config', $murano_paste_config)
+  create_resources('murano_cfapi_paste_ini_config', $murano_cfapi_paste_config)
 }
diff --git a/releasenotes/notes/murano_cfapi_separate_config_file-ca0d487f0606b154.yaml b/releasenotes/notes/murano_cfapi_separate_config_file-ca0d487f0606b154.yaml
new file mode 100644
index 0000000..02b265d
--- /dev/null
+++ b/releasenotes/notes/murano_cfapi_separate_config_file-ca0d487f0606b154.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - Murano CFAPI service configuration has been moved into
+    separate config files (as main config file as paste ini).
diff --git a/spec/classes/murano_cfapi_spec.rb b/spec/classes/murano_cfapi_spec.rb
index 995f5c3..c5da74c 100644
--- a/spec/classes/murano_cfapi_spec.rb
+++ b/spec/classes/murano_cfapi_spec.rb
@@ -15,10 +15,10 @@ describe 'murano::cfapi' do
     it { is_expected.to contain_class('murano::params') }
     it { is_expected.to contain_class('murano::policy') }
 
-    it { is_expected.to contain_murano_config('cfapi/tenant').with_value('admin') }
-    it { is_expected.to contain_murano_config('cfapi/bind_host').with_value('<SERVICE DEFAULT>') }
-    it { is_expected.to contain_murano_config('cfapi/bind_port').with_value('<SERVICE DEFAULT>') }
-    it { is_expected.to contain_murano_config('cfapi/auth_url').with_value('http://127.0.0.1:5000') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/tenant').with_value('admin') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/bind_host').with_value('<SERVICE DEFAULT>') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/bind_port').with_value('<SERVICE DEFAULT>') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/auth_url').with_value('http://127.0.0.1:5000') }
   end
 
   shared_examples_for 'with parameters override' do
@@ -33,10 +33,10 @@ describe 'murano::cfapi' do
     it { is_expected.to contain_class('murano::params') }
     it { is_expected.to contain_class('murano::policy') }
 
-    it { is_expected.to contain_murano_config('cfapi/tenant').with_value('services') }
-    it { is_expected.to contain_murano_config('cfapi/bind_host').with_value('0.0.0.0') }
-    it { is_expected.to contain_murano_config('cfapi/bind_port').with_value(8080) }
-    it { is_expected.to contain_murano_config('cfapi/auth_url').with_value('http://127.0.0.1:5000/v2.0/') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/tenant').with_value('services') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/bind_host').with_value('0.0.0.0') }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/bind_port').with_value(8080) }
+    it { is_expected.to contain_murano_cfapi_config('cfapi/auth_url').with_value('http://127.0.0.1:5000/v2.0/') }
   end
 
   context 'on a RedHat osfamily' do
diff --git a/spec/classes/murano_config_spec.rb b/spec/classes/murano_config_spec.rb
index 39c93d7..2dfda11 100644
--- a/spec/classes/murano_config_spec.rb
+++ b/spec/classes/murano_config_spec.rb
@@ -2,12 +2,19 @@ require 'spec_helper'
 
 describe 'murano::config' do
 
-  let :params do
-    { :murano_config => {
+  let :base_config do
+    {
         'DEFAULT/foo' => { 'value'  => 'fooValue' },
         'DEFAULT/bar' => { 'value'  => 'barValue' },
         'DEFAULT/baz' => { 'ensure' => 'absent' }
-      }
+    }
+  end
+
+  let :params do
+    { :murano_config => base_config,
+      :murano_cfapi_config => base_config,
+      :murano_paste_config => base_config,
+      :murano_cfapi_paste_config => base_config
     }
   end
 
@@ -17,4 +24,22 @@ describe 'murano::config' do
     is_expected.to contain_murano_config('DEFAULT/baz').with_ensure('absent')
   end
 
+  it 'configures murano cfapi configurations' do
+    is_expected.to contain_murano_cfapi_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_murano_cfapi_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_murano_cfapi_config('DEFAULT/baz').with_ensure('absent')
+  end
+
+  it 'configures arbitrary murano paste configurations' do
+    is_expected.to contain_murano_paste_ini_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_murano_paste_ini_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_murano_paste_ini_config('DEFAULT/baz').with_ensure('absent')
+  end
+
+  it 'configures murano cfapi paste configurations' do
+    is_expected.to contain_murano_cfapi_paste_ini_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_murano_cfapi_paste_ini_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_murano_cfapi_paste_ini_config('DEFAULT/baz').with_ensure('absent')
+  end
+
 end
diff --git a/spec/unit/provider/murano_cfapi_config/ini_setting_spec.rb b/spec/unit/provider/murano_cfapi_config/ini_setting_spec.rb
new file mode 100644
index 0000000..b908fa1
--- /dev/null
+++ b/spec/unit/provider/murano_cfapi_config/ini_setting_spec.rb
@@ -0,0 +1,68 @@
+#
+# these tests are a little concerning b/c they are hacking around the
+# modulepath, so these tests will not catch issues that may eventually arise
+# related to loading these plugins.
+# I could not, for the life of me, figure out how to programatcally set the modulepath
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'openstacklib',
+    'lib')
+)
+require 'spec_helper'
+provider_class = Puppet::Type.type(:murano_cfapi_config).provider(:ini_setting)
+describe provider_class do
+
+  it 'should default to the default setting when no other one is specified' do
+    resource = Puppet::Type::Murano_cfapi_config.new(
+      {:name => 'DEFAULT/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('DEFAULT')
+    expect(provider.setting).to eq('foo')
+  end
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Murano_cfapi_config.new(
+      {:name => 'dude/whoa', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('whoa')
+  end
+
+  it 'should ensure absent when <SERVICE DEFAULT> is specified as a value' do
+    resource = Puppet::Type::Murano_cfapi_config.new(
+      {:name => 'dude/foo', :value => '<SERVICE DEFAULT>'}
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+  it 'should ensure absent when value matches ensure_absent_val' do
+    resource = Puppet::Type::Murano_cfapi_config.new(
+      {:name => 'dude/foo', :value => 'foo', :ensure_absent_val => 'foo' }
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+end
diff --git a/spec/unit/provider/murano_cfapi_paste_ini_config/ini_setting_spec.rb b/spec/unit/provider/murano_cfapi_paste_ini_config/ini_setting_spec.rb
new file mode 100644
index 0000000..ec7aea6
--- /dev/null
+++ b/spec/unit/provider/murano_cfapi_paste_ini_config/ini_setting_spec.rb
@@ -0,0 +1,68 @@
+#
+# these tests are a little concerning b/c they are hacking around the
+# modulepath, so these tests will not catch issues that may eventually arise
+# related to loading these plugins.
+# I could not, for the life of me, figure out how to programatcally set the modulepath
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'openstacklib',
+    'lib')
+)
+require 'spec_helper'
+provider_class = Puppet::Type.type(:murano_cfapi_paste_ini_config).provider(:ini_setting)
+describe provider_class do
+
+  it 'should default to the default setting when no other one is specified' do
+    resource = Puppet::Type::Murano_cfapi_paste_ini_config.new(
+      {:name => 'DEFAULT/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('DEFAULT')
+    expect(provider.setting).to eq('foo')
+  end
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Murano_cfapi_paste_ini_config.new(
+      {:name => 'dude/whoa', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('whoa')
+  end
+
+  it 'should ensure absent when <SERVICE DEFAULT> is specified as a value' do
+    resource = Puppet::Type::Murano_cfapi_paste_ini_config.new(
+      {:name => 'dude/foo', :value => '<SERVICE DEFAULT>'}
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+  it 'should ensure absent when value matches ensure_absent_val' do
+    resource = Puppet::Type::Murano_cfapi_paste_ini_config.new(
+      {:name => 'dude/foo', :value => 'foo', :ensure_absent_val => 'foo' }
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+end
diff --git a/spec/unit/type/murano_cfapi_config_spec.rb b/spec/unit/type/murano_cfapi_config_spec.rb
new file mode 100644
index 0000000..f146efc
--- /dev/null
+++ b/spec/unit/type/murano_cfapi_config_spec.rb
@@ -0,0 +1,62 @@
+require 'puppet'
+require 'puppet/type/murano_cfapi_config'
+describe 'Puppet::Type.type(:murano_cfapi_config)' do
+  before :each do
+    @murano_cfapi_config = Puppet::Type.type(:murano_cfapi_config).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+
+  it 'should require a name' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_config).new({})
+    }.to raise_error(Puppet::Error, 'Title or name must be provided')
+  end
+
+  it 'should not expect a name with whitespace' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_config).new(:name => 'f oo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should fail when there is no section' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_config).new(:name => 'foo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should not require a value when ensure is absent' do
+    Puppet::Type.type(:murano_cfapi_config).new(:name => 'DEFAULT/foo', :ensure => :absent)
+  end
+
+  it 'should accept a valid value' do
+    @murano_cfapi_config[:value] = 'bar'
+    expect(@murano_cfapi_config[:value]).to eq('bar')
+  end
+
+  it 'should not accept a value with whitespace' do
+    @murano_cfapi_config[:value] = 'b ar'
+    expect(@murano_cfapi_config[:value]).to eq('b ar')
+  end
+
+  it 'should accept valid ensure values' do
+    @murano_cfapi_config[:ensure] = :present
+    expect(@murano_cfapi_config[:ensure]).to eq(:present)
+    @murano_cfapi_config[:ensure] = :absent
+    expect(@murano_cfapi_config[:ensure]).to eq(:absent)
+  end
+
+  it 'should not accept invalid ensure values' do
+    expect {
+      @murano_cfapi_config[:ensure] = :latest
+    }.to raise_error(Puppet::Error, /Invalid value/)
+  end
+
+  it 'should autorequire the package that install the file' do
+    catalog = Puppet::Resource::Catalog.new
+    package = Puppet::Type.type(:package).new(:name => 'murano-common')
+    catalog.add_resource package, @murano_cfapi_config
+    dependency = @murano_cfapi_config.autorequire
+    expect(dependency.size).to eq(1)
+    expect(dependency[0].target).to eq(@murano_cfapi_config)
+    expect(dependency[0].source).to eq(package)
+  end
+end
diff --git a/spec/unit/type/murano_cfapi_paste_ini_config_spec.rb b/spec/unit/type/murano_cfapi_paste_ini_config_spec.rb
new file mode 100644
index 0000000..fc59c4c
--- /dev/null
+++ b/spec/unit/type/murano_cfapi_paste_ini_config_spec.rb
@@ -0,0 +1,62 @@
+require 'puppet'
+require 'puppet/type/murano_cfapi_paste_ini_config'
+describe 'Puppet::Type.type(:murano_cfapi_paste_ini_config)' do
+  before :each do
+    @murano_cfapi_paste_ini_config = Puppet::Type.type(:murano_cfapi_paste_ini_config).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+
+  it 'should require a name' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_paste_ini_config).new({})
+    }.to raise_error(Puppet::Error, 'Title or name must be provided')
+  end
+
+  it 'should not expect a name with whitespace' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_paste_ini_config).new(:name => 'f oo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should fail when there is no section' do
+    expect {
+      Puppet::Type.type(:murano_cfapi_paste_ini_config).new(:name => 'foo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should not require a value when ensure is absent' do
+    Puppet::Type.type(:murano_cfapi_paste_ini_config).new(:name => 'DEFAULT/foo', :ensure => :absent)
+  end
+
+  it 'should accept a valid value' do
+    @murano_cfapi_paste_ini_config[:value] = 'bar'
+    expect(@murano_cfapi_paste_ini_config[:value]).to eq('bar')
+  end
+
+  it 'should not accept a value with whitespace' do
+    @murano_cfapi_paste_ini_config[:value] = 'b ar'
+    expect(@murano_cfapi_paste_ini_config[:value]).to eq('b ar')
+  end
+
+  it 'should accept valid ensure values' do
+    @murano_cfapi_paste_ini_config[:ensure] = :present
+    expect(@murano_cfapi_paste_ini_config[:ensure]).to eq(:present)
+    @murano_cfapi_paste_ini_config[:ensure] = :absent
+    expect(@murano_cfapi_paste_ini_config[:ensure]).to eq(:absent)
+  end
+
+  it 'should not accept invalid ensure values' do
+    expect {
+      @murano_cfapi_paste_ini_config[:ensure] = :latest
+    }.to raise_error(Puppet::Error, /Invalid value/)
+  end
+
+  it 'should autorequire the package that install the file' do
+    catalog = Puppet::Resource::Catalog.new
+    package = Puppet::Type.type(:package).new(:name => 'murano-common')
+    catalog.add_resource package, @murano_cfapi_paste_ini_config
+    dependency = @murano_cfapi_paste_ini_config.autorequire
+    expect(dependency.size).to eq(1)
+    expect(dependency[0].target).to eq(@murano_cfapi_paste_ini_config)
+    expect(dependency[0].source).to eq(package)
+  end
+end