Document adding multiple AWS accounts to a connection

cloud-access/access-levels-permissions.mdx

@@ -61,13 +61,20 @@ If you prefer to work with each account separately, you can create an AWS connec
 If you want to access multiple accounts together (for example, create a workflow that finds EC2 instances in multiple accounts), you can connect to the accounts from a single OpenOps connection. One account would have to have an assume-role trust with the other accounts. It is common to use the "payer" account in an organization for that purpose. To configure the connection in OpenOps:
 
 1. In the AWS connection UI, configure a connection to your central account using [access keys](#connecting-using-access-keys) or [an IAM role attached to your EC2 instance](#connecting-using-an-iam-role-attached-to-your-ec2-instance). This account must have permission to assume roles in the other accounts.
-2. In the **Roles** section, click **Add Item**.
-3. For each additional AWS account you want to connect to, specify:
-   * **Assume role ARN**: the Amazon resource name (ARN) of the IAM role to assume in this account (e.g., `arn:aws:iam::123456789012:role/OpenOpsExecutionRole`).
-   * **Assume role external ID**: a shared secret defined in the IAM role's trust policy. Leave this field blank if the role does not require an external ID.
-   * **Account alias**: a convenience label used to identify this account in your workflows (e.g., `dev`, `prod`, `billing`).
-
-You can add multiple entries in the **Roles** section to manage many accounts. When configuring a workflow, you'll be able to choose which account to use with each action.
+2. In the **Roles** section, add an entry for each additional AWS account, either one at a time or in bulk:
+   * To add a single account, click **Add Item** and specify:
+     * **Assume role ARN**: the Amazon resource name (ARN) of the IAM role to assume in this account (e.g., `arn:aws:iam::123456789012:role/OpenOpsExecutionRole`).
+     * **Assume role external ID**: a shared secret defined in the IAM role's trust policy. Leave this field blank if the role does not require an external ID.
+     * **Account alias**: a convenience label used to identify this account in your workflows (e.g., `dev`, `prod`, `billing`).
+   * To add many accounts that share the same IAM role name (for example, a role deployed to every account with a CloudFormation StackSet), click **Add multiple accounts** and specify:
+     * **Account IDs**: one account per line as the 12-digit account ID, optionally followed by an alias (e.g., `123456789012 prod-eu`). If you don't provide an alias, the account ID is used.
+     * **Role name**: the name of the IAM role to assume in each listed account. OpenOps builds every ARN as `arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>`.
+     * **External ID**: the shared secret defined in the roles' trust policies. Leave this field blank if the roles do not require an external ID.
+
+     Then click **Add**. OpenOps adds one entry to the **Roles** section per account. Account IDs that aren't 12 digits or are already listed are skipped and reported so you can fix them.
+3. Review the entries in the **Roles** section and edit any of them if needed, then click **Save**. OpenOps verifies that it can assume every role and, if any fail, lists all of them with the reason so you can fix them in one go.
+
+When configuring a workflow, you'll be able to choose which account to use with each action.
 
 ## Azure connections