Add runas_passwd as a global for states

doc/ref/states/requisites.rst

@@ -519,7 +519,8 @@ runas
 
 .. versionadded:: 2017.7.0
 
-The ``runas`` global option is used to set the user which will be used to run the command in the ``cmd.run`` module.
+The ``runas`` global option is used to set the user which will be used to run
+the command in the ``cmd.run`` module.
 
 .. code-block:: yaml
 
@@ -532,6 +533,26 @@ The ``runas`` global option is used to set the user which will be used to run th
 
 In the above state, the pip command run by ``cmd.run`` will be run by the daniel user.
 
+runas_passwd
+~~~~~~~~~~~~
+
+.. versionadded:: 2017.7.2
+
+The ``runas_passwd`` global option is used to set the password used by the runas
+global option. This is required by ``cmd.run`` on Windows when ``runas`` is
+specified. It will be set when ``password`` is defined in the state.
+
+.. code-block:: yaml
+
+    run_script:
+      cmd.run:
+        - name: Powershell -NonInteractive -ExecutionPolicy Bypass -File C:\\Temp\\script.ps1
+        - runas: frank
+        - password: supersecret
+
+In the above state, the Powershell script run by ``cmd.run`` will be run by the
+frank user with the password ``supersecret``.
+
 .. _requisites-require-in:
 .. _requisites-watch-in:
 .. _requisites-onchanges-in:

salt/modules/cmdmod.py

@@ -294,6 +294,9 @@ def _run(cmd,
     if runas is None and '__context__' in globals():
         runas = __context__.get('runas')
 
+    if password is None and '__context__' in globals():
+        password = __context__.get('runas_passwd')
+
     # Set the default working directory to the home directory of the user
     # salt-minion is running as. Defaults to home directory of user under which
     # the minion is running.

salt/state.py

@@ -1751,6 +1751,7 @@ class State(object):
             ret = {'result': False, 'name': low['name'], 'changes': {}}
 
         self.state_con['runas'] = low.get('runas', None)
+        self.state_con['runas_passwd'] = low.get('runas_passwd', None)
 
         if not low.get('__prereq__'):
             log.info(