Previously unattended upgrades were setup during the install. Since we wanted to verify that the upgrades were still setup, it has been moved into puppet.
If you are using the puppetlabs::apt module, the setup is basically a one liner;
include apt::unattended_upgrades
This sets up the unattended security upgrades by default. The machine will check and download the updates daily, and flush the local cache every 7 days.