is there a better way to generate secret than the cli? We are using s3 bucket for the state. Some people doesn’t have the role in production to set the secret. I wanted to know if someone is using another way to generate the secret correclty? awskms is the security provider.

no, this isn't possible to the best of my knowledge. This is one of the reasons using the service helps you