I am using saltstack to start up an arangodb instance on a centos7 machine. I would like to start it up with a custom password, so I would like to run ARANGODB_DEFAULT_ROOT_PASSWORD=<my password> arango-secure-installation after the arangodb 3.5 rpm is installed on the machine but before it starts up, because you can only set the password while it is not running. I'm not sure how to do that exactly with salt stack, but I assume it has something to do with the cmd.run salt function.
Here's the installation/startup salt code I have:

arangodb_3_server:
  pkg.latest:
    - refresh: True
    - pkgs:
      - arangodb3
    cmd.run:
      - name: "ARANGODB_DEFAULT_ROOT_PASSWORD={{ arangodb.get('ARANGO_ROOT_PASSWORD', '') }} arango-secure-installation"
  service.running:
    - name: arangodb3
    - enable: True
    - watch:
      - file: /etc/arangodb3/arangod.conf

So I'm wondering can I basically just put the secure-installation command somewhere to accomplish this? From what I've tried I've only gotten compilation errors or it doesn't set the password.