add task to auto-run update task if status is before/after

tasks/pam.yml

@@ -1,4 +1,5 @@
 ---
+- block:
     - name: Set pam module configuration
       pamd:
         name: "{{ item.name | default('system-auth') }}"
@@ -11,5 +12,16 @@
         state: "{{ item.state | default('args_present') }}"
         module_arguments: "{{ item.module_arguments | default(omit) }}"
       loop: "{{ pam_settings + pam_settings_extra }}"
+    
+    - name: Auto-update items with state: before/after
+      pamd:
+        name: "{{ item.name | default('system-auth') }}"
+        type: "{{ item.new_type }}"
+        module_path: "{{ item.new_module_path }}"
+        control: "{{ item.new_control }}"
+        state: updated
+        module_arguments: "{{ item.module_arguments | default(omit) }}"
+      loop: "{{ pam_settings + pam_settings_extra }}"
+      when: item.state == "before" or item.state == "after"
   become: True
   become_user: root