You can use FNDCPASS to change the virtualized EBS instance password after post-clone configuration (as a Configure Clone Hook operation). Note that you will need to update the APPS password on the back of the dbTechStack and appsTier vFiles card afterwards since the production password is no longer in use.
Another note, if you want to refresh the dbTechStack or appsTier, you’ll need to:
Shutdown the virtual EBS instance (which requires the non-prod password)
Change the password stored with the dbTechStack and appsTier to the production password
Perform the refresh
Change the password back to the desired non-production password
(We realize this process is more manual than it needs to be, and it is on our radar to craft a cleaner solution.)