I'd say, from my experience with Ansible, that it can absolutely do all of that. Might be able to use a single task for the package install, if the distro supports the generic package module. There's also a pamd module that would likely cover your needs there. If not, it would still be possible with a custom module or some Xinfile fuckery (if it can be fine programmatically, it can be done in Ansible, more niche things may require writing code, however).

It would not be as terse though. Really wish there was a good middle ground.