test.sls

{% for files in [
  {'cis': '5.3.3 Ensure password reuse is limited (Scored)', 'name': 'pwquality'},
  {'cis': '5.3.4 Ensure password hashing algorithm is SHA-512 (Scored)', 'name': 'unix'}
  ]
%}

{{ files.cis }}:
  file.managed:
    - source: salt://files/pam/{{files.name}}
    - name: /usr/share/pam-configs/{{files.name}}
    - mode: 644
pam-auth-update {{ file.cis }}:
  cmd.run:
    - name: DEBIAN_FRONTEND=noninteractive pam-auth-update --force
    - onchanges_in:
      - file: /usr/share/pam-configs/{{files.name}}
{% endfor %}

the result

----------
          ID: 5.3.3 Ensure password reuse is limited (Scored)
    Function: file.managed
        Name: /usr/share/pam-configs/pwquality
      Result: True
     Comment: File /usr/share/pam-configs/pwquality is in the correct state
     Started: 01:18:25.766196
    Duration: 24.368 ms
     Changes:
----------
          ID: pam-auth-update 5.3.3 Ensure password reuse is limited (Scored)
    Function: cmd.run
        Name: DEBIAN_FRONTEND=noninteractive pam-auth-update --force
      Result: True
     Comment: State was not run because none of the onchanges reqs changed
     Started: 01:18:25.792289
    Duration: 0.01 ms
     Changes:
----------
          ID: 5.3.4 Ensure password hashing algorithm is SHA-512 (Scored)
    Function: file.managed
        Name: /usr/share/pam-configs/unix
      Result: True
     Comment: File /usr/share/pam-configs/unix is in the correct state
     Started: 01:18:25.792352
    Duration: 22.829 ms
     Changes:
----------
          ID: pam-auth-update 5.3.4 Ensure password hashing algorithm is SHA-512 (Scored)
    Function: cmd.run
        Name: DEBIAN_FRONTEND=noninteractive pam-auth-update --force
      Result: True
     Comment: State was not run because none of the onchanges reqs changed
     Started: 01:18:25.815842
    Duration: 0.009 ms
     Changes: