By default Puppet doesn't follow symlinks when updating files so with /etc/pam.d/system-auth being a symlink to /etc/pam.d/system-auth-ac it wasn't being updated. Added 'links => follow' and this now works as expected.
In /etc/pam.d system-auth is a symlink to system-auth-ac so update that instead.