Currently, if you don't want to hardcode password in the scenario configuration YAML, you can use --password cmdline parameter, which can be used to set password for all the units. It is not flexible enough as it should be possible to pass different passwords for different units.
The new solution should use environment variables like this: dbstress_${unit_name}_${property}=${value}.