Modifying pam with Ansible

As part of a new server setup, I provision /etc/security/access.conf with user/group and src IP addresses of allowed ssh logins. This requires enabling pam_access in the /etc/pam.d/login and /etc/pam.d/sshd files (on Ubuntu anyway)

It seems Ansible has a module for modifying some of these rules but I can't get it to work. A stipulation of the modules is: "In order for a PAM rule to be modified, the type, control and module_path must match an existing rule." Does that mean if a rule is commented out, the pamd module will not work for enabling that line?

This is my current playbook. I've tried removing the with_items line in the task and using login for the name: parameter but that doesn't seem to work either:

---
- hosts: all
  gather_facts: False
  tasks:
    - name: modify pam_access in /etc/pam.d for sshd and login
      pamd:
        name   : "{{ item }}"
        type   : account
        control: required
        module_path: pam_access.so
      with_items:
        - login
        - sshd

And this the result of running it. It doesn't give me much to go on:

$ ansible-playbook tests/pam-access.yml -i 192.168.24.66,                                                             
SUDO password: 

PLAY [all] ***********************************************************************************************************

TASK [modify pam_access in /etc/pam.d for sshd and login] ************************************************************
ok: [192.168.24.66] => (item=login)
failed: [192.168.24.66] (item=sshd) => {"changed": false, "item": "sshd", "module_stderr": "Shared connection to 192.168.24.66 closed.\r\n", "module_stdout": "\r\nTraceback (most recent call last):\r\n  File \"/tmp/ansible_vzO7tZ/ansible_module_pamd.py\", line 691, in <module>\r\n    main()\r\n  File \"/tmp/ansible_vzO7tZ/ansible_module_pamd.py\", line 645, in main\r\n    pamd.load_rules_from_file()\r\n  File \"/tmp/ansible_vzO7tZ/ansible_module_pamd.py\", line 361, in load_rules_from_file\r\n    self.load_rules_from_string(stringline.replace(\"\\\\\\n\", \"\"))\r\n  File \"/tmp/ansible_vzO7tZ/ansible_module_pamd.py\", line 380, in load_rules_from_string\r\n    self.rules.append(PamdRule.rulefromstring(stringline))\r\n  File \"/tmp/ansible_vzO7tZ/ansible_module_pamd.py\", line 312, in rulefromstring\r\n    rule_type = result.group(1)\r\nAttributeError: 'NoneType' object has no attribute 'group'\r\n", "msg": "MODULE FAILURE", "rc": 1}

PLAY RECAP ***********************************************************************************************************
192.168.24.66              : ok=0    changed=0    unreachable=0    failed=1