1. run the command to create a password hash.
grub2-mkpasswd-pbkdf2
2. edit the following file like this
vi /etc/grub.d/01_users
#!/bin/sh -e
cat << EOF
set superusers="root"
password_pbkdf2 root grub.pbkdf2.sha512.10000.6A9A780AF06AFA821060956BC089B89A4F5A24F593268FED5DB42978EC7F956BD51FC7BB815B2ABF0BA8EC7F96DA7444B6254725505E06BED12C4AA97485CBFF.AF4A12B70E499340EF97720EF21434A55F1D124B9B9D062413314C8B554197235A525FD0F73C24FBDAF534F5A54CA576FDBF3456526A520BA5F087696B5F8047
EOF
3. apply the password to grub
grub2-mkconfig -o /boot/grub2/grub.cfg