diff --git a/cloud-access/access-levels-permissions.mdx b/cloud-access/access-levels-permissions.mdx
index d22a897..f302387 100644
--- a/cloud-access/access-levels-permissions.mdx
+++ b/cloud-access/access-levels-permissions.mdx
@@ -61,13 +61,20 @@ If you prefer to work with each account separately, you can create an AWS connec
 If you want to access multiple accounts together (for example, create a workflow that finds EC2 instances in multiple accounts), you can connect to the accounts from a single OpenOps connection. One account would have to have an assume-role trust with the other accounts. It is common to use the "payer" account in an organization for that purpose. To configure the connection in OpenOps:
 
 1. In the AWS connection UI, configure a connection to your central account using [access keys](#connecting-using-access-keys) or [an IAM role attached to your EC2 instance](#connecting-using-an-iam-role-attached-to-your-ec2-instance). This account must have permission to assume roles in the other accounts.
-2. In the **Roles** section, click **Add Item**.
-3. For each additional AWS account you want to connect to, specify:
-   * **Assume role ARN**: the Amazon resource name (ARN) of the IAM role to assume in this account (e.g., `arn:aws:iam::123456789012:role/OpenOpsExecutionRole`).
-   * **Assume role external ID**: a shared secret defined in the IAM role's trust policy. Leave this field blank if the role does not require an external ID.
-   * **Account alias**: a convenience label used to identify this account in your workflows (e.g., `dev`, `prod`, `billing`).
-
-You can add multiple entries in the **Roles** section to manage many accounts. When configuring a workflow, you'll be able to choose which account to use with each action.
+2. In the **Roles** section, add an entry for each additional AWS account, either one at a time or in bulk:
+   * To add a single account, click **Add Item** and specify:
+     * **Assume role ARN**: the Amazon resource name (ARN) of the IAM role to assume in this account (e.g., `arn:aws:iam::123456789012:role/OpenOpsExecutionRole`).
+     * **Assume role external ID**: a shared secret defined in the IAM role's trust policy. Leave this field blank if the role does not require an external ID.
+     * **Account alias**: a convenience label used to identify this account in your workflows (e.g., `dev`, `prod`, `billing`).
+   * To add many accounts that share the same IAM role name (for example, a role deployed to every account with a CloudFormation StackSet), click **Add multiple accounts** and specify:
+     * **Account IDs**: one account per line as the 12-digit account ID, optionally followed by an alias (e.g., `123456789012 prod-eu`). If you don't provide an alias, the account ID is used.
+     * **Role name**: the name of the IAM role to assume in each listed account. OpenOps builds every ARN as `arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>`.
+     * **External ID**: the shared secret defined in the roles' trust policies. Leave this field blank if the roles do not require an external ID.
+
+     Then click **Add**. OpenOps adds one entry to the **Roles** section per account. Account IDs that aren't 12 digits or are already listed are skipped and reported so you can fix them.
+3. Review the entries in the **Roles** section and edit any of them if needed, then click **Save**. OpenOps verifies that it can assume every role and, if any fail, lists all of them with the reason so you can fix them in one go.
+
+When configuring a workflow, you'll be able to choose which account to use with each action.
 
 ## Azure connections
 
diff --git a/images/access-aws-connection.png b/images/access-aws-connection.png
index b12f43d..99a3f01 100644
Binary files a/images/access-aws-connection.png and b/images/access-aws-connection.png differ