diff --git a/bumiworker/bumiworker/modules/recommendations/s3_intelligent_tiering.py b/bumiworker/bumiworker/modules/recommendations/s3_intelligent_tiering.py
index 70d25410f..606df860d 100644
--- a/bumiworker/bumiworker/modules/recommendations/s3_intelligent_tiering.py
+++ b/bumiworker/bumiworker/modules/recommendations/s3_intelligent_tiering.py
@@ -1,6 +1,6 @@
 import logging
 from collections import defaultdict
-from concurrent.futures.thread import ThreadPoolExecutor
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from typing import Any, Dict, List, Tuple
 from datetime import datetime, date, timedelta
 
@@ -205,7 +205,7 @@ def _display_name(storage_type):
             })
         metrics = aws.get_cloud_watch_metric_data(
             region, metric_queries, today,
-            today - timedelta(days=7))
+            today - timedelta(days=2))
         for md in metrics.get("MetricDataResults", []):
             values = md.get("Values") or []
             if not values:
@@ -228,14 +228,21 @@ def _candidates_and_savings(self,
         """
         buckets_data = {}
         result = []
-        with ThreadPoolExecutor(max_workers=50) as executor:
+        if not region_candidates:
+            return result
+        cw_clients = {
+            region: aws.session.client("cloudwatch", region_name=region)
+            for region in region_candidates
+        }
+        max_workers = min(20, sum(len(v) for v in region_candidates.values()))
+        with ThreadPoolExecutor(max_workers=max_workers) as executor:
             futures = []
-            for region, candidates in region_candidates.items():
-                s3_client = aws.session.client("s3", region_name=region)
-                for cand in candidates:
+            for region, buckets in region_candidates.items():
+                cloudwatch = cw_clients[region]
+                for bucket in buckets:
                     futures.append(executor.submit(
-                        aws.get_bucket_storage_info, s3_client, cand, ))
-            for f in futures:
+                        aws.get_bucket_storage_info, cloudwatch, bucket, ))
+            for f in as_completed(futures):
                 res = f.result()
                 if res:
                     buckets_data.update(res)
diff --git a/ngui/server/graphql/__generated__/types/restapi.ts b/ngui/server/graphql/__generated__/types/restapi.ts
index 4c67fb666..070b6f9d2 100644
--- a/ngui/server/graphql/__generated__/types/restapi.ts
+++ b/ngui/server/graphql/__generated__/types/restapi.ts
@@ -82,6 +82,7 @@ export type AwsAssumedRoleConfigInput = {
   region_name?: InputMaybe<Scalars["String"]["input"]>;
   report_name?: InputMaybe<Scalars["String"]["input"]>;
   use_edp_discount?: InputMaybe<Scalars["Boolean"]["input"]>;
+  linked?: InputMaybe<Scalars["Boolean"]["input"]>;
 };
 
 export type AwsConfig = {
diff --git a/ngui/server/graphql/typeDefs/restapi/restapi.ts b/ngui/server/graphql/typeDefs/restapi/restapi.ts
index 5ba5a65f4..a5fea37e9 100644
--- a/ngui/server/graphql/typeDefs/restapi/restapi.ts
+++ b/ngui/server/graphql/typeDefs/restapi/restapi.ts
@@ -359,6 +359,7 @@ export default gql`
     cur_version: Int
     config_scheme: String
     report_name: String
+    linked: Boolean
   }
 
   input AzureSubscriptionConfigInput {
diff --git a/ngui/ui/src/components/Button/Button.tsx b/ngui/ui/src/components/Button/Button.tsx
index 7a2029d17..bdd14aa46 100644
--- a/ngui/ui/src/components/Button/Button.tsx
+++ b/ngui/ui/src/components/Button/Button.tsx
@@ -30,7 +30,7 @@ type ButtonText = ExclusiveUnion<{
   pepega: string;
 }>;
 
-type ButtonProps = MuiButtonProps &
+export type ButtonProps = MuiButtonProps &
   ButtonText &
   NavProps & {
     dataTestId?: string;
diff --git a/ngui/ui/src/components/CanvasBarChart/CanvasBarChart.tsx b/ngui/ui/src/components/CanvasBarChart/CanvasBarChart.tsx
index c39d4f51a..fd7f61c06 100644
--- a/ngui/ui/src/components/CanvasBarChart/CanvasBarChart.tsx
+++ b/ngui/ui/src/components/CanvasBarChart/CanvasBarChart.tsx
@@ -428,6 +428,7 @@ const CanvasBarChart = ({
 
 const ResponsiveCanvasBarChart = ({
   data,
+  wrapperRef,
   keys = [],
   style = {},
   isLoading = false,
@@ -454,6 +455,7 @@ const ResponsiveCanvasBarChart = ({
       style={{
         height: muiTheme.spacing(height)
       }}
+      ref={wrapperRef}
     >
       <ResponsiveWrapper>
         {({ width: wrapperWidth, height: wrapperHeight }) => {
diff --git a/ngui/ui/src/components/CloudResourceId/CloudResourceId.tsx b/ngui/ui/src/components/CloudResourceId/CloudResourceId.tsx
index e9bbfc587..19ff69b8f 100644
--- a/ngui/ui/src/components/CloudResourceId/CloudResourceId.tsx
+++ b/ngui/ui/src/components/CloudResourceId/CloudResourceId.tsx
@@ -46,7 +46,13 @@ const CloudResourceId = (props) => {
 
   // Additional check to handle cloudResourceIdentifier having 'null' or 'undefined' substring
   if (separator && cloudResourceIdentifier.includes(separator)) {
-    const shortenedCloudResourceId = `${SHORTENED_CLOUD_RESOURCE_ID_PREFIX}${cloudResourceIdentifier.split(separator).pop()}`;
+    // If the path ends with "/", take last 3 segments (last segment is empty)
+    // Example: "path/to/resource/" -> ["to", "resource", ""] -> "to/resource/"
+    const shortId = cloudResourceIdentifier.endsWith(separator)
+      ? cloudResourceIdentifier.split(separator).slice(-3).join(separator)
+      : cloudResourceIdentifier.split(separator).pop();
+
+    const shortenedCloudResourceId = `${SHORTENED_CLOUD_RESOURCE_ID_PREFIX}${shortId}`;
 
     return (
       <CloudResourceIdString
diff --git a/ngui/ui/src/components/DataSourceCredentialFields/AwsAssumedRoleInputs/AwsAssumedRoleInputs.tsx b/ngui/ui/src/components/DataSourceCredentialFields/AwsAssumedRoleInputs/AwsAssumedRoleInputs.tsx
index 4cffd9491..4a735177c 100644
--- a/ngui/ui/src/components/DataSourceCredentialFields/AwsAssumedRoleInputs/AwsAssumedRoleInputs.tsx
+++ b/ngui/ui/src/components/DataSourceCredentialFields/AwsAssumedRoleInputs/AwsAssumedRoleInputs.tsx
@@ -7,19 +7,25 @@ import AwsUseAwsEdpDiscount from "../AwsUseAwsEdpDiscount";
 
 const AwsAssumedRoleInputs = ({
   readOnlyFields = [],
-  showAssumedRoleCredentialsInModal = false
+  showAssumedRoleCredentialsInModal = false,
+  showAdvancedOptions = true
 }: {
   readOnlyFields?: string[];
   showAssumedRoleCredentialsInModal?: boolean;
+  showAdvancedOptions?: boolean;
 }) => (
   <>
     <AwsAssumedRoleCredentials readOnlyFields={readOnlyFields} />
-    <AwsUseAwsEdpDiscount />
-    <Typography gutterBottom data-test-id="p_cost_and_usage_report_parameters_description">
-      <FormattedMessage id="costAndUsageReportParametersDescription" />
-    </Typography>
-    <AwsExportType />
-    <AwsBillingBucketInputs showAssumedRoleCredentialsInModal={showAssumedRoleCredentialsInModal} />
+    {showAdvancedOptions && (
+      <>
+        <AwsUseAwsEdpDiscount />
+        <Typography gutterBottom data-test-id="p_cost_and_usage_report_parameters_description">
+          <FormattedMessage id="costAndUsageReportParametersDescription" />
+        </Typography>
+        <AwsExportType />
+        <AwsBillingBucketInputs showAssumedRoleCredentialsInModal={showAssumedRoleCredentialsInModal} />
+      </>
+    )}
   </>
 );
 
diff --git a/ngui/ui/src/components/DataSourceDetails/Properties/AwsProperties.tsx b/ngui/ui/src/components/DataSourceDetails/Properties/AwsProperties.tsx
index 3c15ade2e..52507a09f 100644
--- a/ngui/ui/src/components/DataSourceDetails/Properties/AwsProperties.tsx
+++ b/ngui/ui/src/components/DataSourceDetails/Properties/AwsProperties.tsx
@@ -21,14 +21,18 @@ const AwsProperties = ({ accountId, config, createdAt }: AwsPropertiesProps) =>
 
   const getAwsAccountTypeMessageId = () => {
     if (linked) {
-      return "linked";
+      return "member";
     }
 
+    return "managementStandalone";
+  };
+
+  const getAwsAuthenticationTypeMessageId = () => {
     if (isAssumeRole) {
       return "assumedRole";
     }
 
-    return "root";
+    return "accessKey";
   };
 
   return (
@@ -57,6 +61,11 @@ const AwsProperties = ({ accountId, config, createdAt }: AwsPropertiesProps) =>
           value: `p_${AWS_CNR}_value`
         }}
       />
+      <KeyValueLabel
+        keyMessageId="awsAuthenticationType"
+        value={<FormattedMessage id={getAwsAuthenticationTypeMessageId()} />}
+        dataTestIds={{ key: "p_authentication_type_key", value: "p_authentication_type_value" }}
+      />
       {isAssumeRole && (
         <KeyValueLabel
           keyMessageId="awsRoleName"
diff --git a/ngui/ui/src/components/WrapperCard/WrapperCard.tsx b/ngui/ui/src/components/WrapperCard/WrapperCard.tsx
index 4784df525..e8ff4807f 100644
--- a/ngui/ui/src/components/WrapperCard/WrapperCard.tsx
+++ b/ngui/ui/src/components/WrapperCard/WrapperCard.tsx
@@ -9,31 +9,30 @@ import IconButton from "components/IconButton";
 import Tooltip from "components/Tooltip";
 import WidgetTitle from "components/WidgetTitle";
 import WrapperCardTitlePdf from "components/WrapperCardTitlePdf/WrapperCardTitlePdf";
+import { TitleProps, WrapperCardProps } from "./types";
 import useStyles from "./WrapperCard.styles";
 
-const renderButton = (type, buttonProps) => (type === "icon" ? <IconButton {...buttonProps} /> : <Button {...buttonProps} />);
+const Title = ({ title, titleButton, dataTestId }: TitleProps) => {
+  const titleMessage = <WidgetTitle dataTestId={dataTestId}>{title}</WidgetTitle>;
 
-const renderTitleButton = (options) => {
-  const { type, tooltip, buttonProps } = options;
-  return tooltip ? <Tooltip title={tooltip.title}>{renderButton(type, buttonProps)}</Tooltip> : renderButton(type, buttonProps);
-};
+  if (!titleButton) {
+    return titleMessage;
+  }
 
-const Title = ({ title, titleButton, dataTestId }) => {
-  const titleMessage = <WidgetTitle dataTestId={dataTestId}>{title}</WidgetTitle>;
+  const { type, tooltip, buttonProps } = titleButton;
+  const buttonElement = type === "icon" ? <IconButton {...buttonProps} /> : <Button {...buttonProps} />;
 
-  const button = titleButton && renderTitleButton(titleButton);
+  const button = tooltip ? <Tooltip title={tooltip.title}>{buttonElement}</Tooltip> : buttonElement;
 
-  return button ? (
+  return (
     <Box display="flex" alignItems="center">
-      {titleButton.type === "icon" ? titleMessage : <Box mr={1}>{titleMessage}</Box>}
+      {type === "icon" ? titleMessage : <Box mr={1}>{titleMessage}</Box>}
       {button}
     </Box>
-  ) : (
-    titleMessage
   );
 };
 
-const WrapperCard = forwardRef(
+const WrapperCard = forwardRef<HTMLDivElement, WrapperCardProps>(
   (
     {
       title,
diff --git a/ngui/ui/src/components/WrapperCard/types.ts b/ngui/ui/src/components/WrapperCard/types.ts
new file mode 100644
index 000000000..d50341d79
--- /dev/null
+++ b/ngui/ui/src/components/WrapperCard/types.ts
@@ -0,0 +1,54 @@
+import { ReactNode } from "react";
+import type { CardProps } from "@mui/material";
+import { ButtonProps } from "components/Button/Button";
+import { IconButtonProps } from "components/IconButton/IconButton";
+import { TODO } from "utils/types";
+
+type ButtonConfig =
+  | {
+      type: "icon";
+      buttonProps: IconButtonProps;
+    }
+  | {
+      type: "button";
+      buttonProps: ButtonProps;
+    };
+
+type TitleButtonOptions = {
+  tooltip?: { title: ReactNode };
+} & ButtonConfig;
+
+type DataTestIdsOptions = {
+  wrapper?: string;
+  title?: string;
+  titleCaption?: string;
+  button?: string;
+};
+
+type ButtonOptions = {
+  show: boolean;
+  href?: string;
+  link?: string;
+  messageId: string;
+};
+
+export type TitleProps = {
+  title: ReactNode;
+  titleButton?: TitleButtonOptions;
+  dataTestId?: string;
+};
+
+export type WrapperCardProps = Omit<CardProps, "title"> & {
+  title: ReactNode;
+  titleCaption?: ReactNode;
+  titleButton?: TitleButtonOptions;
+  dataTestIds?: DataTestIdsOptions;
+  children?: ReactNode;
+  className?: string;
+  button?: ButtonOptions;
+  needAlign?: boolean;
+  titlePdf?: {
+    id: string;
+    renderData: () => TODO;
+  };
+};
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/ConnectCloudAccountForm.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/ConnectCloudAccountForm.tsx
index 427c64620..68237a6d8 100644
--- a/ngui/ui/src/components/forms/ConnectCloudAccountForm/ConnectCloudAccountForm.tsx
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/ConnectCloudAccountForm.tsx
@@ -1,9 +1,10 @@
-import { useEffect, useState } from "react";
+import { ReactNode, useEffect, useState } from "react";
+import { Stack } from "@mui/material";
 import Box from "@mui/material/Box";
 import Link from "@mui/material/Link";
 import Paper from "@mui/material/Paper";
 import Typography from "@mui/material/Typography";
-import { FormProvider, useForm } from "react-hook-form";
+import { FieldValues, FormProvider, useForm } from "react-hook-form";
 import { FormattedMessage } from "react-intl";
 import Button from "components/Button";
 import ButtonGroup from "components/ButtonGroup/ButtonGroup";
@@ -11,18 +12,17 @@ import ButtonLoader from "components/ButtonLoader";
 import CapabilityWrapper from "components/CapabilityWrapper";
 import {
   ALIBABA_CREDENTIALS_FIELD_NAMES,
-  AZURE_TENANT_CREDENTIALS_FIELD_NAMES,
-  AZURE_SUBSCRIPTION_CREDENTIALS_FIELD_NAMES,
-  GCP_CREDENTIALS_FIELD_NAMES,
-  GCP_TENANT_CREDENTIALS_FIELD_NAMES,
-  KUBERNETES_CREDENTIALS_FIELD_NAMES,
-  DATABRICKS_CREDENTIALS_FIELD_NAMES,
-  AWS_ROOT_CREDENTIALS_FIELD_NAMES,
   AWS_BILLING_BUCKET_FIELD_NAMES,
   AWS_EXPORT_TYPE_FIELD_NAMES,
-  AWS_LINKED_CREDENTIALS_FIELD_NAMES,
+  AWS_ROLE_CREDENTIALS_FIELD_NAMES,
+  AWS_ROOT_CREDENTIALS_FIELD_NAMES,
   AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES,
-  AWS_ROLE_CREDENTIALS_FIELD_NAMES
+  AZURE_SUBSCRIPTION_CREDENTIALS_FIELD_NAMES,
+  AZURE_TENANT_CREDENTIALS_FIELD_NAMES,
+  DATABRICKS_CREDENTIALS_FIELD_NAMES,
+  GCP_CREDENTIALS_FIELD_NAMES,
+  GCP_TENANT_CREDENTIALS_FIELD_NAMES,
+  KUBERNETES_CREDENTIALS_FIELD_NAMES
 } from "components/DataSourceCredentialFields";
 import FormButtonsWrapper from "components/FormButtonsWrapper";
 import { FIELD_NAMES as NEBIUS_FIELD_NAMES } from "components/NebiusConfigFormElements";
@@ -35,36 +35,31 @@ import DatabricksLogoIcon from "icons/DatabricksLogoIcon";
 import GcpLogoIcon from "icons/GcpLogoIcon";
 import K8sLogoIcon from "icons/K8sLogoIcon";
 import NebiusLogoIcon from "icons/NebiusLogoIcon";
-import { intl } from "translations/react-intl-config";
 import {
-  DOCS_HYSTAX_CONNECT_AWS_ROOT,
-  DOCS_HYSTAX_CONNECT_AZURE_TENANT,
-  DOCS_HYSTAX_AWS_LINKED_DISCOVER_RESOURCES,
-  GITHUB_HYSTAX_K8S_COST_METRICS_COLLECTOR,
-  GITHUB_HYSTAX_EXTRACT_LINKED_REPORTS,
+  DATABRICKS_CREATE_SERVICE_PRINCIPAL,
   DOCS_HYSTAX_CONNECT_ALIBABA_CLOUD,
+  DOCS_HYSTAX_CONNECT_AZURE_SUBSCRIPTION,
+  DOCS_HYSTAX_CONNECT_AZURE_TENANT,
   DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD,
-  DATABRICKS_CREATE_SERVICE_PRINCIPAL,
+  DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD_TENANT,
   DOCS_HYSTAX_CONNECT_KUBERNETES,
-  DOCS_HYSTAX_CONNECT_AWS_LINKED,
-  DOCS_HYSTAX_CONNECT_AZURE_SUBSCRIPTION,
-  DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD_TENANT
+  GITHUB_HYSTAX_K8S_COST_METRICS_COLLECTOR
 } from "urls";
-import { trackEvent, GA_EVENT_CATEGORIES } from "utils/analytics";
+import { GA_EVENT_CATEGORIES, trackEvent } from "utils/analytics";
 import {
+  ALIBABA_CNR,
   AWS_CNR,
+  AWS_ROOT_CONNECT_CONFIG_SCHEMES,
   AZURE_CNR,
   AZURE_TENANT,
-  KUBERNETES_CNR,
-  AWS_ROOT_CONNECT_CONFIG_SCHEMES,
-  ALIBABA_CNR,
-  GCP_CNR,
-  NEBIUS,
+  CLOUD_PROVIDERS,
+  CONNECTION_TYPES,
   DATABRICKS,
-  OPTSCALE_CAPABILITY,
+  GCP_CNR,
   GCP_TENANT,
-  CONNECTION_TYPES,
-  CLOUD_PROVIDERS
+  KUBERNETES_CNR,
+  NEBIUS,
+  OPTSCALE_CAPABILITY
 } from "utils/constants";
 import { readFileAsText } from "utils/files";
 import { SPACING_2 } from "utils/layouts";
@@ -72,7 +67,14 @@ import { getSearchParams } from "utils/network";
 import { ObjectValues } from "utils/types";
 import useStyles from "./ConnectCloudAccountForm.styles";
 import { ConnectionInputs, DataSourceNameField } from "./FormElements";
-import { AWS_ROOT_INPUTS_FIELD_NAMES } from "./FormElements/ConnectionFields";
+import {
+  AuthenticationTypeSelector,
+  getAwsConnectionTypeDescriptions,
+  useAuthenticationType,
+  AUTHENTICATION_TYPES,
+  AWS_ROOT_INPUTS_FIELD_NAMES,
+  AuthenticationType
+} from "./FormElements/AwsConnectionForm";
 import { FIELD_NAME as DATA_SOURCE_NAME_FIELD_NAME } from "./FormElements/DataSourceNameField";
 
 type ConnectionType = ObjectValues<typeof CONNECTION_TYPES>;
@@ -105,9 +107,8 @@ type CloudProviderTypes = Record<
 
 const CLOUD_PROVIDER_TYPES: CloudProviderTypes = {
   [CLOUD_PROVIDERS.AWS]: [
-    { connectionType: CONNECTION_TYPES.AWS_ROLE, messageId: "assumedRole", cloudType: AWS_CNR },
-    { connectionType: CONNECTION_TYPES.AWS_ROOT, messageId: "root", cloudType: AWS_CNR },
-    { connectionType: CONNECTION_TYPES.AWS_LINKED, messageId: "linked", cloudType: AWS_CNR }
+    { connectionType: CONNECTION_TYPES.AWS_MANAGEMENT, messageId: "managementStandalone", cloudType: AWS_CNR },
+    { connectionType: CONNECTION_TYPES.AWS_MEMBER, messageId: "member", cloudType: AWS_CNR }
   ],
   [CLOUD_PROVIDERS.AZURE]: [
     { connectionType: CONNECTION_TYPES.AZURE_TENANT, messageId: "tenant", cloudType: AZURE_TENANT },
@@ -146,7 +147,7 @@ const getCloudTypeFromConnectionType = (connectionType: ConnectionType): CloudTy
   return providerTypes.cloudType;
 };
 
-const getAwsRootParameters = (formData) => {
+const getAwsRootParameters = (formData: FieldValues, connectionType: string) => {
   const getConfigSchemeParameters = () =>
     formData.isFindReport
       ? {
@@ -159,35 +160,26 @@ const getAwsRootParameters = (formData) => {
           region_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.REGION_NAME] || undefined,
           config_scheme: formData[AWS_ROOT_INPUTS_FIELD_NAMES.CONFIG_SCHEME]
         };
+
+  const extraParams = {
+    use_edp_discount: formData[AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES.USE_EDP_DISCOUNT],
+    cur_version: Number(formData[AWS_EXPORT_TYPE_FIELD_NAMES.CUR_VERSION]),
+    ...getConfigSchemeParameters()
+  };
+
   return {
     name: formData[DATA_SOURCE_NAME_FIELD_NAME],
     type: AWS_CNR,
     config: {
       access_key_id: formData[AWS_ROOT_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID],
       secret_access_key: formData[AWS_ROOT_CREDENTIALS_FIELD_NAMES.SECRET_ACCESS_KEY],
-      use_edp_discount: formData[AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES.USE_EDP_DISCOUNT],
-      cur_version: Number(formData[AWS_EXPORT_TYPE_FIELD_NAMES.CUR_VERSION]),
-      ...getConfigSchemeParameters()
+      ...(connectionType !== CONNECTION_TYPES.AWS_MEMBER ? extraParams : { linked: true })
     }
   };
 };
 
-const getAwsLinkedParameters = (formData) => ({
-  name: formData[DATA_SOURCE_NAME_FIELD_NAME],
-  type: AWS_CNR,
-  config: {
-    access_key_id: formData[AWS_LINKED_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID],
-    secret_access_key: formData[AWS_LINKED_CREDENTIALS_FIELD_NAMES.SECRET_ACCESS_KEY],
-    linked: true
-  }
-});
-
-const getAwsAssumedRoleParameters = (formData) => ({
-  name: formData[DATA_SOURCE_NAME_FIELD_NAME],
-  type: AWS_CNR,
-  config: {
-    assume_role_account_id: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID],
-    assume_role_name: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_NAME],
+const getAwsAssumedRoleParameters = (formData: FieldValues, connectionType: string) => {
+  const extraParams = {
     use_edp_discount: formData[AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES.USE_EDP_DISCOUNT],
     cur_version: Number(formData[AWS_EXPORT_TYPE_FIELD_NAMES.CUR_VERSION]),
     bucket_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.BUCKET_NAME],
@@ -195,19 +187,29 @@ const getAwsAssumedRoleParameters = (formData) => ({
     report_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.EXPORT_NAME],
     region_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.REGION_NAME] || undefined,
     config_scheme: AWS_ROOT_CONNECT_CONFIG_SCHEMES.BUCKET_ONLY
-  }
-});
-
-const getAwsParametersByConnectionType = (connectionType: string) => {
-  const parameters = {
-    [CONNECTION_TYPES.AWS_LINKED]: getAwsLinkedParameters,
-    [CONNECTION_TYPES.AWS_ROLE]: getAwsAssumedRoleParameters
-  }[connectionType];
+  };
 
-  return parameters || getAwsRootParameters;
+  return {
+    name: formData[DATA_SOURCE_NAME_FIELD_NAME],
+    type: AWS_CNR,
+    config: {
+      assume_role_account_id: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID],
+      assume_role_name: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_NAME],
+      ...(connectionType !== CONNECTION_TYPES.AWS_MEMBER
+        ? extraParams
+        : {
+            linked: true
+          })
+    }
+  };
 };
 
-const getAzureTenantParameters = (formData) => ({
+const getAwsParametersByAuthenticationType = (connectionType: string, authenticationType: AuthenticationType) =>
+  authenticationType === AUTHENTICATION_TYPES.ACCESS_KEY
+    ? (formData: FieldValues) => getAwsRootParameters(formData, connectionType)
+    : (formData: FieldValues) => getAwsAssumedRoleParameters(formData, connectionType);
+
+const getAzureTenantParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: AZURE_TENANT,
   config: {
@@ -217,7 +219,7 @@ const getAzureTenantParameters = (formData) => ({
   }
 });
 
-const getAzureSubscriptionParameters = (formData) => ({
+const getAzureSubscriptionParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: AZURE_CNR,
   config: {
@@ -236,7 +238,7 @@ const getAzureSubscriptionParameters = (formData) => ({
   }
 });
 
-const getKubernetesParameters = (formData) => ({
+const getKubernetesParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: KUBERNETES_CNR,
   config: {
@@ -247,7 +249,7 @@ const getKubernetesParameters = (formData) => ({
   }
 });
 
-const getAlibabaParameters = (formData) => ({
+const getAlibabaParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: ALIBABA_CNR,
   config: {
@@ -256,14 +258,14 @@ const getAlibabaParameters = (formData) => ({
   }
 });
 
-const getGoogleParameters = async (formData) => {
+const getGoogleParameters = async (formData: FieldValues) => {
   const credentials = await readFileAsText(formData[GCP_CREDENTIALS_FIELD_NAMES.CREDENTIALS]);
 
   return {
     name: formData[DATA_SOURCE_NAME_FIELD_NAME],
     type: GCP_CNR,
     config: {
-      credentials: JSON.parse(credentials),
+      credentials: JSON.parse(credentials as string),
       billing_data: {
         dataset_name: formData[GCP_CREDENTIALS_FIELD_NAMES.BILLING_DATA_DATASET],
         table_name: formData[GCP_CREDENTIALS_FIELD_NAMES.BILLING_DATA_TABLE],
@@ -282,14 +284,14 @@ const getGoogleParameters = async (formData) => {
   };
 };
 
-const getGoogleTenantParameters = async (formData) => {
+const getGoogleTenantParameters = async (formData: FieldValues) => {
   const credentials = await readFileAsText(formData[GCP_TENANT_CREDENTIALS_FIELD_NAMES.CREDENTIALS]);
 
   return {
     name: formData[DATA_SOURCE_NAME_FIELD_NAME],
     type: GCP_TENANT,
     config: {
-      credentials: JSON.parse(credentials),
+      credentials: JSON.parse(credentials as string),
       billing_data: {
         dataset_name: formData[GCP_TENANT_CREDENTIALS_FIELD_NAMES.BILLING_DATA_DATASET],
         table_name: formData[GCP_TENANT_CREDENTIALS_FIELD_NAMES.BILLING_DATA_TABLE]
@@ -306,7 +308,7 @@ const getGoogleTenantParameters = async (formData) => {
   };
 };
 
-const getNebiusParameters = (formData) => ({
+const getNebiusParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: NEBIUS,
   config: {
@@ -326,7 +328,7 @@ const getNebiusParameters = (formData) => ({
   }
 });
 
-const getDatabricksParameters = (formData) => ({
+const getDatabricksParameters = (formData: FieldValues) => ({
   name: formData[DATA_SOURCE_NAME_FIELD_NAME],
   type: DATABRICKS,
   config: {
@@ -344,94 +346,68 @@ const renderConnectionTypeDescription = (settings) =>
     </Typography>
   ));
 
-const renderConnectionTypeInfoMessage = (connectionType: ConnectionType) =>
+const renderConnectionTypeInfoMessage = (connectionType: ConnectionType, authenticationType: AuthenticationType) =>
   ({
-    [CONNECTION_TYPES.AWS_ROLE]: renderConnectionTypeDescription([
-      {
-        key: "createAwsAssumedRoleDescription",
-        messageId: "createAwsAssumedRoleDescription",
-        values: { action: intl.formatMessage({ id: "connect" }) }
-      }
-    ]),
-    [CONNECTION_TYPES.AWS_ROOT]: renderConnectionTypeDescription([
+    ...getAwsConnectionTypeDescriptions(authenticationType),
+    [CONNECTION_TYPES.AZURE_TENANT]: renderConnectionTypeDescription([
       {
-        key: "createAwsRootDocumentationReference",
-        messageId: "createAwsRootDocumentationReference",
+        key: "createAzureSubscriptionDocumentationReference",
+        messageId: "createAzureSubscriptionDocumentationReference",
         values: {
-          link: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AWS_ROOT} target="_blank" rel="noopener">
+          link: (chunks: ReactNode) => (
+            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AZURE_TENANT} target="_blank" rel="noopener">
               {chunks}
             </Link>
           ),
-          strong: (chunks) => <strong>{chunks}</strong>
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>
         }
       }
     ]),
-    [CONNECTION_TYPES.AWS_LINKED]: renderConnectionTypeDescription([
-      {
-        key: "createAwsLinkedDocumentationReference1",
-        messageId: "createAwsLinkedDocumentationReference1",
-        values: {
-          autoBillingAwsLink: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AWS_LINKED} target="_blank" rel="noopener">
-              {chunks}
-            </Link>
-          )
-        }
-      },
-      {
-        key: "createAwsLinkedDocumentationReference2",
-        messageId: "createAwsLinkedDocumentationReference2",
-        values: {
-          extractLinkedReports: (
-            <Link
-              data-test-id="extract_linked_reports"
-              href={GITHUB_HYSTAX_EXTRACT_LINKED_REPORTS}
-              target="_blank"
-              rel="noopener"
-            >
-              {GITHUB_HYSTAX_EXTRACT_LINKED_REPORTS}
-            </Link>
-          )
-        }
-      },
+    [CONNECTION_TYPES.AZURE_SUBSCRIPTION]: renderConnectionTypeDescription([
       {
-        key: "createAwsLinkedDocumentationReference3",
-        messageId: "createAwsLinkedDocumentationReference3",
+        key: "createAzureSubscriptionDocumentationReference",
+        messageId: "createAzureSubscriptionDocumentationReference",
         values: {
-          discoverResourcesLink: (chunks) => (
-            <Link data-test-id="link_iam_user" href={DOCS_HYSTAX_AWS_LINKED_DISCOVER_RESOURCES} target="_blank" rel="noopener">
+          link: (chunks: ReactNode) => (
+            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AZURE_SUBSCRIPTION} target="_blank" rel="noopener">
               {chunks}
             </Link>
-          )
+          ),
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>
         }
       }
     ]),
-    [CONNECTION_TYPES.AZURE_TENANT]: renderConnectionTypeDescription([
+    [CONNECTION_TYPES.GCP_PROJECT]: renderConnectionTypeDescription([
       {
-        key: "createAzureSubscriptionDocumentationReference",
-        messageId: "createAzureSubscriptionDocumentationReference",
+        key: "createGCPDocumentationReference",
+        messageId: "createGCPDocumentationReference",
         values: {
-          link: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AZURE_TENANT} target="_blank" rel="noopener">
+          link: (chunks: ReactNode) => (
+            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD} target="_blank" rel="noopener">
               {chunks}
             </Link>
           ),
-          strong: (chunks) => <strong>{chunks}</strong>
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>,
+          p: (chunks: ReactNode) => <p>{chunks}</p>
         }
       }
     ]),
-    [CONNECTION_TYPES.AZURE_SUBSCRIPTION]: renderConnectionTypeDescription([
+    [CONNECTION_TYPES.GCP_TENANT]: renderConnectionTypeDescription([
       {
-        key: "createAzureSubscriptionDocumentationReference",
-        messageId: "createAzureSubscriptionDocumentationReference",
+        key: "createGCPTenantDocumentationReference1",
+        messageId: "createGCPTenantDocumentationReference1"
+      },
+      {
+        key: "createGCPTenantDocumentationReference2",
+        messageId: "createGCPTenantDocumentationReference2",
         values: {
-          link: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_AZURE_SUBSCRIPTION} target="_blank" rel="noopener">
+          link: (chunks: ReactNode) => (
+            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD_TENANT} target="_blank" rel="noopener">
               {chunks}
             </Link>
           ),
-          strong: (chunks) => <strong>{chunks}</strong>
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>,
+          p: (chunks: ReactNode) => <p>{chunks}</p>
         }
       }
     ]),
@@ -440,7 +416,7 @@ const renderConnectionTypeInfoMessage = (connectionType: ConnectionType) =>
         key: "createKubernetesDocumentationReference1",
         messageId: "createKubernetesDocumentationReference1",
         values: {
-          link: (chunks) => (
+          link: (chunks: ReactNode) => (
             <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_KUBERNETES} target="_blank" rel="noopener">
               {chunks}
             </Link>
@@ -460,7 +436,7 @@ const renderConnectionTypeInfoMessage = (connectionType: ConnectionType) =>
               {GITHUB_HYSTAX_K8S_COST_METRICS_COLLECTOR}
             </Link>
           ),
-          p: (chunks) => <p>{chunks}</p>
+          p: (chunks: ReactNode) => <p>{chunks}</p>
         }
       }
     ]),
@@ -469,12 +445,12 @@ const renderConnectionTypeInfoMessage = (connectionType: ConnectionType) =>
         key: "createAlibabaDocumentationReference",
         messageId: "createAlibabaDocumentationReference",
         values: {
-          link: (chunks) => (
+          link: (chunks: ReactNode) => (
             <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_ALIBABA_CLOUD} target="_blank" rel="noopener">
               {chunks}
             </Link>
           ),
-          strong: (chunks) => <strong>{chunks}</strong>
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>
         }
       }
     ]),
@@ -483,46 +459,12 @@ const renderConnectionTypeInfoMessage = (connectionType: ConnectionType) =>
         key: "createDatabricksDocumentationReference",
         messageId: "createDatabricksDocumentationReference",
         values: {
-          link: (chunks) => (
+          link: (chunks: ReactNode) => (
             <Link data-test-id="link_guide" href={DATABRICKS_CREATE_SERVICE_PRINCIPAL} target="_blank" rel="noopener">
               {chunks}
             </Link>
           ),
-          strong: (chunks) => <strong>{chunks}</strong>
-        }
-      }
-    ]),
-    [CONNECTION_TYPES.GCP_PROJECT]: renderConnectionTypeDescription([
-      {
-        key: "createGCPDocumentationReference",
-        messageId: "createGCPDocumentationReference",
-        values: {
-          link: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD} target="_blank" rel="noopener">
-              {chunks}
-            </Link>
-          ),
-          strong: (chunks) => <strong>{chunks}</strong>,
-          p: (chunks) => <p>{chunks}</p>
-        }
-      }
-    ]),
-    [CONNECTION_TYPES.GCP_TENANT]: renderConnectionTypeDescription([
-      {
-        key: "createGCPTenantDocumentationReference1",
-        messageId: "createGCPTenantDocumentationReference1"
-      },
-      {
-        key: "createGCPTenantDocumentationReference2",
-        messageId: "createGCPTenantDocumentationReference2",
-        values: {
-          link: (chunks) => (
-            <Link data-test-id="link_guide" href={DOCS_HYSTAX_CONNECT_GOOGLE_CLOUD_TENANT} target="_blank" rel="noopener">
-              {chunks}
-            </Link>
-          ),
-          strong: (chunks) => <strong>{chunks}</strong>,
-          p: (chunks) => <p>{chunks}</p>
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>
         }
       }
     ]),
@@ -563,9 +505,11 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
       return connectionTypeFromQueryParams;
     }
 
-    return CONNECTION_TYPES.AWS_ROLE;
+    return CONNECTION_TYPES.AWS_MANAGEMENT;
   });
 
+  const { authenticationType, setAuthenticationType } = useAuthenticationType();
+
   const selectedProvider = getCloudProviderFromConnectionType(connectionType);
 
   const { classes, cx } = useStyles();
@@ -580,7 +524,7 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
       icon: AwsLogoIcon,
       messageId: "aws",
       dataTestId: "btn_aws_account",
-      action: () => setConnectionType(CONNECTION_TYPES.AWS_ROLE)
+      action: () => setConnectionType(CONNECTION_TYPES.AWS_MANAGEMENT)
     },
     {
       id: CLOUD_PROVIDERS.AZURE,
@@ -635,6 +579,37 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
       : isDataSourceConnectionTypeEnabled(providerTypes.connectionType);
   });
 
+  const renderFormTabs = () => {
+    if (!Array.isArray(CLOUD_PROVIDER_TYPES[selectedProvider])) {
+      return null;
+    }
+
+    return (
+      <>
+        <Stack direction="row" alignItems="center" spacing={2} mb={2}>
+          <Typography>
+            <FormattedMessage id={selectedProvider === CLOUD_PROVIDERS.AWS ? "accountType" : "connectionType"} />
+          </Typography>
+          <ButtonGroup
+            buttons={CLOUD_PROVIDER_TYPES[selectedProvider]
+              .filter((subtype) => isDataSourceConnectionTypeEnabled(subtype.connectionType))
+              .map((subtype) => ({
+                id: subtype.connectionType,
+                messageId: subtype.messageId,
+                dataTestId: `btn_${subtype.messageId}`,
+                action: () => setConnectionType(subtype.connectionType)
+              }))}
+            activeButtonId={connectionType}
+          />
+        </Stack>
+
+        {selectedProvider === CLOUD_PROVIDERS.AWS && (
+          <AuthenticationTypeSelector authenticationType={authenticationType} setAuthenticationType={setAuthenticationType} />
+        )}
+      </>
+    );
+  };
+
   return (
     <FormProvider {...methods}>
       <Box sx={{ width: { md: "50%" } }}>
@@ -665,24 +640,8 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
           ))}
         </Box>
         <Box>
-          {Array.isArray(CLOUD_PROVIDER_TYPES[selectedProvider]) && (
-            <Box alignItems="center" display="flex" mb={1}>
-              <Typography sx={{ mr: 1 }}>
-                <FormattedMessage id="connectionType" />{" "}
-              </Typography>
-              <ButtonGroup
-                buttons={CLOUD_PROVIDER_TYPES[selectedProvider]
-                  .filter((subtype) => isDataSourceConnectionTypeEnabled(subtype.connectionType))
-                  .map((subtype) => ({
-                    id: subtype.connectionType,
-                    messageId: subtype.messageId,
-                    action: () => setConnectionType(subtype.connectionType)
-                  }))}
-                activeButtonId={connectionType}
-              />
-            </Box>
-          )}
-          <Box sx={{ marginBottom: SPACING_2 }}>{renderConnectionTypeInfoMessage(connectionType)}</Box>
+          {renderFormTabs()}
+          <Box sx={{ marginBottom: SPACING_2 }}>{renderConnectionTypeInfoMessage(connectionType, authenticationType)}</Box>
           <form
             onSubmit={
               isRestricted
@@ -691,7 +650,7 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
                     const cloudType = getCloudTypeFromConnectionType(connectionType);
 
                     const getParameters = {
-                      [AWS_CNR]: getAwsParametersByConnectionType(connectionType),
+                      [AWS_CNR]: getAwsParametersByAuthenticationType(connectionType, authenticationType),
                       [AZURE_TENANT]: getAzureTenantParameters,
                       [AZURE_CNR]: getAzureSubscriptionParameters,
                       [GCP_CNR]: getGoogleParameters,
@@ -708,7 +667,7 @@ const ConnectCloudAccountForm = ({ onSubmit, onCancel, isLoading = false, showCa
             noValidate
           >
             <DataSourceNameField />
-            <ConnectionInputs connectionType={connectionType} />
+            <ConnectionInputs connectionType={connectionType} authenticationType={authenticationType} />
             <FormButtonsWrapper justifyContent={!showCancel ? "center" : "left"}>
               <ButtonLoader
                 dataTestId="btn_connect_cloud_account"
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionAccessKeyInputs.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionAccessKeyInputs.tsx
new file mode 100644
index 000000000..22cc17e0f
--- /dev/null
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionAccessKeyInputs.tsx
@@ -0,0 +1,77 @@
+import Typography from "@mui/material/Typography";
+import { FormattedMessage } from "react-intl";
+import ConnectForm from "components/ConnectForm";
+import {
+  AwsBillingBucket,
+  AwsExportType,
+  AwsRootCredentials,
+  AwsUseAwsEdpDiscount
+} from "components/DataSourceCredentialFields";
+import { RadioGroup, Switch } from "components/forms/common/fields";
+import QuestionMark from "components/QuestionMark";
+import { AWS_ROOT_CONNECT_CONFIG_SCHEMES } from "utils/constants";
+import { AWS_ROOT_INPUTS_FIELD_NAMES } from "./constants";
+
+export const AwsConnectionAccessKeyInputs = ({ showAdvancesOptions = true }) => (
+  <ConnectForm>
+    {({ watch }) => {
+      const isFindReportWatch = watch(AWS_ROOT_INPUTS_FIELD_NAMES.IS_FIND_REPORT, true);
+      const configScheme =
+        watch(AWS_ROOT_INPUTS_FIELD_NAMES.CONFIG_SCHEME, AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT) ||
+        AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT;
+      return (
+        <>
+          <AwsRootCredentials />
+          {showAdvancesOptions && (
+            <>
+              <AwsUseAwsEdpDiscount />
+              <AwsExportType />
+              <Switch
+                name={AWS_ROOT_INPUTS_FIELD_NAMES.IS_FIND_REPORT}
+                label={<FormattedMessage id="dataExportDetection" />}
+                defaultValue={isFindReportWatch}
+                adornment={
+                  <QuestionMark
+                    messageId="dataExportDetectionTooltip"
+                    messageValues={{
+                      break: <br />
+                    }}
+                    dataTestId="qmark_data_export_detection"
+                  />
+                }
+              />
+              {!isFindReportWatch && (
+                <>
+                  <RadioGroup
+                    name={AWS_ROOT_INPUTS_FIELD_NAMES.CONFIG_SCHEME}
+                    defaultValue={configScheme}
+                    radioButtons={[
+                      {
+                        value: AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT,
+                        label: <FormattedMessage id="createNewCostUsageReport" />
+                      },
+                      {
+                        value: AWS_ROOT_CONNECT_CONFIG_SCHEMES.BUCKET_ONLY,
+                        label: <FormattedMessage id="connectOnlyToDataInBucket" />
+                      }
+                    ]}
+                  />
+                  <Typography gutterBottom data-test-id="p_data_export_detection_description">
+                    <FormattedMessage
+                      id={
+                        configScheme === AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT
+                          ? "dataExportDetectionDescription1"
+                          : "dataExportDetectionDescription2"
+                      }
+                    />
+                  </Typography>
+                  <AwsBillingBucket />
+                </>
+              )}
+            </>
+          )}
+        </>
+      );
+    }}
+  </ConnectForm>
+);
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionFormElements.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionFormElements.tsx
new file mode 100644
index 000000000..dca006c09
--- /dev/null
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/AwsConnectionFormElements.tsx
@@ -0,0 +1,90 @@
+import React, { ReactNode, useState } from "react";
+import { Stack } from "@mui/material";
+import Alert from "@mui/material/Alert";
+import Box from "@mui/material/Box";
+import Link from "@mui/material/Link";
+import Typography from "@mui/material/Typography";
+import { FormattedMessage } from "react-intl";
+import ButtonGroup from "components/ButtonGroup";
+import {
+  AUTHENTICATION_TYPES,
+  authenticationTypes,
+  awsConnectionAssumedRoleDescriptions,
+  awsConnectionKeyAccessDescriptions
+} from "./constants";
+import { AuthenticationType, AuthenticationTypeSelectorType, AwsTypeDescriptionProps } from "./types";
+
+export const AwsTypeDescription = ({
+  messageId,
+  linkUrl,
+  linkDisplayBlock = false,
+  type = "paragraph"
+}: AwsTypeDescriptionProps) => {
+  const content = (
+    <Typography>
+      <FormattedMessage
+        id={messageId}
+        values={{
+          link: (chunks: ReactNode[]) => {
+            const linkText = chunks.length > 0 ? chunks : linkUrl;
+            return (
+              <Link
+                data-test-id="link_guide"
+                sx={{ display: linkDisplayBlock ? "inline" : "block" }}
+                href={linkUrl}
+                target="_blank"
+                rel="noopener"
+              >
+                {linkText}
+              </Link>
+            );
+          },
+          strong: (chunks: ReactNode) => <strong>{chunks}</strong>
+        }}
+      />
+    </Typography>
+  );
+
+  if (type === "warning") {
+    return (
+      <Alert severity="warning" sx={{ mt: 1, mb: 1 }}>
+        {content}
+      </Alert>
+    );
+  }
+
+  return (
+    <Box key={messageId} sx={{ mt: 1, mb: 1 }}>
+      {content}
+    </Box>
+  );
+};
+
+export const useAuthenticationType = () => {
+  const [authenticationType, setAuthenticationType] = useState<AuthenticationType>(() => AUTHENTICATION_TYPES.ASSUMED_ROLE);
+  return { authenticationType, setAuthenticationType };
+};
+
+export const AuthenticationTypeSelector = ({ authenticationType, setAuthenticationType }: AuthenticationTypeSelectorType) => (
+  <Stack direction="row" alignItems="center" spacing={2} mb={2}>
+    <Typography>
+      <FormattedMessage id="authentication" />{" "}
+    </Typography>
+    <ButtonGroup
+      buttons={authenticationTypes.map((subtype) => ({
+        id: subtype.authenticationType,
+        messageId: subtype.messageId,
+        dataTestId: `btn_${subtype.messageId}`,
+        action: () => setAuthenticationType(subtype.authenticationType)
+      }))}
+      activeButtonId={authenticationType}
+      activeButtonIndex={undefined}
+      fullWidth={false}
+    />
+  </Stack>
+);
+
+export const getAwsConnectionTypeDescriptions = (authenticationType: AuthenticationType) =>
+  authenticationType === AUTHENTICATION_TYPES.ASSUMED_ROLE
+    ? awsConnectionAssumedRoleDescriptions
+    : awsConnectionKeyAccessDescriptions;
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/constants.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/constants.tsx
new file mode 100644
index 000000000..247cc4184
--- /dev/null
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/constants.tsx
@@ -0,0 +1,75 @@
+import React from "react";
+import { DOCS_HYSTAX_CONNECT_AWS_ROOT } from "urls";
+import { AWS_CNR, CONNECTION_TYPES } from "utils/constants";
+import { AwsTypeDescription } from "./AwsConnectionFormElements";
+
+export const AUTHENTICATION_TYPES = Object.freeze({
+  ASSUMED_ROLE: "assumedRole",
+  ACCESS_KEY: "accessKey"
+});
+
+export const authenticationTypes = [
+  {
+    authenticationType: AUTHENTICATION_TYPES.ASSUMED_ROLE,
+    messageId: "assumedRole",
+    cloudType: AWS_CNR
+  },
+  { authenticationType: AUTHENTICATION_TYPES.ACCESS_KEY, messageId: "accessKey", cloudType: AWS_CNR }
+];
+
+export const AWS_ROOT_INPUTS_FIELD_NAMES = {
+  IS_FIND_REPORT: "isFindReport",
+  CONFIG_SCHEME: "configScheme"
+};
+
+const awsDefaultAssumedRoleDescriptions = [
+  <AwsTypeDescription key="1" messageId="createAwsMemberAssumedRoleDescriptions" />,
+  <AwsTypeDescription
+    key="2"
+    messageId="createAwsDefaultAssumedRoleDocumentationReference3"
+    linkUrl={DOCS_HYSTAX_CONNECT_AWS_ROOT}
+  />
+];
+
+const awsDefaultAccessKeyDescriptions = [
+  <AwsTypeDescription
+    key="1"
+    messageId="createAwsDefaultAssumedRoleDocumentationReference1"
+    linkUrl={DOCS_HYSTAX_CONNECT_AWS_ROOT}
+    linkDisplayBlock
+    type={"warning"}
+  />,
+  <AwsTypeDescription key="2" messageId="createAwsDefaultAssumedRoleDocumentationReference2" />,
+  <AwsTypeDescription
+    key="3"
+    messageId="createAwsDefaultAssumedRoleDocumentationReference3"
+    linkUrl={DOCS_HYSTAX_CONNECT_AWS_ROOT}
+  />
+];
+
+const awsMemberAccessKeyDescriptions = [
+  <AwsTypeDescription
+    key="1"
+    messageId="createAwsDefaultAssumedRoleDocumentationReference1"
+    linkUrl={DOCS_HYSTAX_CONNECT_AWS_ROOT}
+    linkDisplayBlock
+    type={"warning"}
+  />,
+  <AwsTypeDescription key="2" messageId="createAwsDefaultAssumedRoleDocumentationReference4" />,
+  <AwsTypeDescription
+    key="3"
+    messageId="createAwsDefaultAssumedRoleDocumentationReference3"
+    linkUrl={DOCS_HYSTAX_CONNECT_AWS_ROOT}
+    linkDisplayBlock={false}
+  />
+];
+
+export const awsConnectionAssumedRoleDescriptions = {
+  [CONNECTION_TYPES.AWS_MANAGEMENT]: awsDefaultAssumedRoleDescriptions,
+  [CONNECTION_TYPES.AWS_MEMBER]: awsDefaultAssumedRoleDescriptions
+};
+
+export const awsConnectionKeyAccessDescriptions = {
+  [CONNECTION_TYPES.AWS_MANAGEMENT]: awsDefaultAccessKeyDescriptions,
+  [CONNECTION_TYPES.AWS_MEMBER]: awsMemberAccessKeyDescriptions
+};
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/index.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/index.tsx
new file mode 100644
index 000000000..514db2d88
--- /dev/null
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/index.tsx
@@ -0,0 +1,27 @@
+import { AwsConnectionAccessKeyInputs } from "./AwsConnectionAccessKeyInputs";
+import {
+  AuthenticationTypeSelector,
+  getAwsConnectionTypeDescriptions,
+  useAuthenticationType
+} from "./AwsConnectionFormElements";
+import {
+  AUTHENTICATION_TYPES,
+  authenticationTypes,
+  awsConnectionAssumedRoleDescriptions,
+  awsConnectionKeyAccessDescriptions,
+  AWS_ROOT_INPUTS_FIELD_NAMES
+} from "./constants";
+import { AuthenticationType } from "./types";
+
+export {
+  AUTHENTICATION_TYPES,
+  AWS_ROOT_INPUTS_FIELD_NAMES,
+  authenticationTypes,
+  awsConnectionAssumedRoleDescriptions,
+  awsConnectionKeyAccessDescriptions,
+  getAwsConnectionTypeDescriptions,
+  useAuthenticationType,
+  AuthenticationTypeSelector,
+  AwsConnectionAccessKeyInputs
+};
+export type { AuthenticationType };
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/types.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/types.tsx
new file mode 100644
index 000000000..6b4746b07
--- /dev/null
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/AwsConnectionForm/types.tsx
@@ -0,0 +1,16 @@
+import { ObjectValues } from "utils/types";
+import { AUTHENTICATION_TYPES } from "./constants";
+
+export type AuthenticationType = ObjectValues<typeof AUTHENTICATION_TYPES>;
+
+export type AuthenticationTypeSelectorType = {
+  authenticationType: string;
+  setAuthenticationType: (type: AuthenticationType) => void;
+};
+
+export type AwsTypeDescriptionProps = {
+  messageId: string;
+  type?: "paragraph" | "warning";
+  linkUrl?: string;
+  linkDisplayBlock?: boolean;
+};
diff --git a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/ConnectionFields.tsx b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/ConnectionFields.tsx
index 8ada2516c..8b10d7fc6 100644
--- a/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/ConnectionFields.tsx
+++ b/ngui/ui/src/components/forms/ConnectCloudAccountForm/FormElements/ConnectionFields.tsx
@@ -1,24 +1,15 @@
-import Box from "@mui/material/Box";
-import Typography from "@mui/material/Typography";
-import { FormattedMessage } from "react-intl";
-import ConnectForm from "components/ConnectForm";
+import { Box } from "@mui/material";
 import {
-  AlibabaCredentials,
-  AwsRootCredentials,
-  AwsLinkedCredentials,
   AzureTenantCredentials,
   AzureSubscriptionCredentials,
-  NebiusCredentials,
   GcpCredentials,
-  KubernetesCredentials,
-  DatabricksCredentials,
-  AwsBillingBucket,
-  AwsExportType,
-  AwsUseAwsEdpDiscount,
   GcpTenantCredentials,
-  AwsAssumedRoleInputs
+  AwsAssumedRoleInputs,
+  AlibabaCredentials,
+  DatabricksCredentials,
+  KubernetesCredentials,
+  NebiusCredentials
 } from "components/DataSourceCredentialFields";
-import { RadioGroup, Switch } from "components/forms/common/fields";
 import {
   BillingReportBucketDescription,
   BillingReportBucketTitle,
@@ -27,74 +18,9 @@ import {
   ReportBucketPathPrefix,
   ServiceAccountCredentialsDescription
 } from "components/NebiusConfigFormElements";
-import QuestionMark from "components/QuestionMark";
-import { AWS_ROOT_CONNECT_CONFIG_SCHEMES, CONNECTION_TYPES } from "utils/constants";
+import { CONNECTION_TYPES } from "utils/constants";
 import { ObjectValues } from "utils/types";
-
-export const AWS_ROOT_INPUTS_FIELD_NAMES = {
-  IS_FIND_REPORT: "isFindReport",
-  CONFIG_SCHEME: "configScheme"
-};
-
-const AwsRootInputs = () => (
-  <ConnectForm>
-    {({ watch }) => {
-      const isFindReportWatch = watch(AWS_ROOT_INPUTS_FIELD_NAMES.IS_FIND_REPORT, true);
-      const configScheme =
-        watch(AWS_ROOT_INPUTS_FIELD_NAMES.CONFIG_SCHEME, AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT) ||
-        AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT;
-      return (
-        <>
-          <AwsRootCredentials />
-          <AwsUseAwsEdpDiscount />
-          <AwsExportType />
-          <Switch
-            name={AWS_ROOT_INPUTS_FIELD_NAMES.IS_FIND_REPORT}
-            label={<FormattedMessage id="dataExportDetection" />}
-            defaultValue={isFindReportWatch}
-            adornment={
-              <QuestionMark
-                messageId="dataExportDetectionTooltip"
-                messageValues={{
-                  break: <br />
-                }}
-                dataTestId="qmark_data_export_detection"
-              />
-            }
-          />
-          {!isFindReportWatch && (
-            <>
-              <RadioGroup
-                name={AWS_ROOT_INPUTS_FIELD_NAMES.CONFIG_SCHEME}
-                defaultValue={configScheme}
-                radioButtons={[
-                  {
-                    value: AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT,
-                    label: <FormattedMessage id="createNewCostUsageReport" />
-                  },
-                  {
-                    value: AWS_ROOT_CONNECT_CONFIG_SCHEMES.BUCKET_ONLY,
-                    label: <FormattedMessage id="connectOnlyToDataInBucket" />
-                  }
-                ]}
-              />
-              <Typography gutterBottom data-test-id="p_data_export_detection_description">
-                <FormattedMessage
-                  id={
-                    configScheme === AWS_ROOT_CONNECT_CONFIG_SCHEMES.CREATE_REPORT
-                      ? "dataExportDetectionDescription1"
-                      : "dataExportDetectionDescription2"
-                  }
-                />
-              </Typography>
-              <AwsBillingBucket />
-            </>
-          )}
-        </>
-      );
-    }}
-  </ConnectForm>
-);
+import { AUTHENTICATION_TYPES, AuthenticationType, AwsConnectionAccessKeyInputs } from "./AwsConnectionForm";
 
 const NebiusInputs = () => (
   <>
@@ -114,24 +40,37 @@ const NebiusInputs = () => (
 
 type ConnectionType = ObjectValues<typeof CONNECTION_TYPES>;
 
-const ConnectionInputs = ({ connectionType }: { connectionType: ConnectionType }) => {
+const renderAwsInputs = (connectionType: ConnectionType, authenticationType: AuthenticationType | null) => {
+  const showAdvancedOptions = connectionType !== CONNECTION_TYPES.AWS_MEMBER;
+
+  return authenticationType === AUTHENTICATION_TYPES.ASSUMED_ROLE ? (
+    <AwsAssumedRoleInputs showAssumedRoleCredentialsInModal showAdvancedOptions={showAdvancedOptions} />
+  ) : (
+    <AwsConnectionAccessKeyInputs showAdvancesOptions={showAdvancedOptions} />
+  );
+};
+
+const ConnectionInputs = ({
+  connectionType,
+  authenticationType
+}: {
+  connectionType: ConnectionType;
+  authenticationType: AuthenticationType | null;
+}) => {
   switch (connectionType) {
-    case CONNECTION_TYPES.AWS_ROLE:
-      return <AwsAssumedRoleInputs showAssumedRoleCredentialsInModal />;
-    case CONNECTION_TYPES.AWS_ROOT:
-      return <AwsRootInputs />;
-    case CONNECTION_TYPES.AWS_LINKED:
-      return <AwsLinkedCredentials />;
+    case CONNECTION_TYPES.AWS_MANAGEMENT:
+    case CONNECTION_TYPES.AWS_MEMBER:
+      return renderAwsInputs(connectionType, authenticationType);
     case CONNECTION_TYPES.AZURE_TENANT:
       return <AzureTenantCredentials />;
     case CONNECTION_TYPES.AZURE_SUBSCRIPTION:
       return <AzureSubscriptionCredentials />;
-    case CONNECTION_TYPES.ALIBABA:
-      return <AlibabaCredentials />;
     case CONNECTION_TYPES.GCP_PROJECT:
       return <GcpCredentials />;
     case CONNECTION_TYPES.GCP_TENANT:
       return <GcpTenantCredentials />;
+    case CONNECTION_TYPES.ALIBABA:
+      return <AlibabaCredentials />;
     case CONNECTION_TYPES.NEBIUS:
       return <NebiusInputs />;
     case CONNECTION_TYPES.DATABRICKS:
diff --git a/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/FormElements/CredentialInputs.tsx b/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/FormElements/CredentialInputs.tsx
index 03ead3cc2..591ddd62c 100644
--- a/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/FormElements/CredentialInputs.tsx
+++ b/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/FormElements/CredentialInputs.tsx
@@ -72,12 +72,17 @@ const CostAndUsageReport = () => {
 
 const CredentialInputs = ({ type, config }) => {
   const getAwsInputs = (config) => {
-    if (config.linked) {
-      return <AwsLinkedCredentials />;
+    if (config.assume_role_account_id && config.assume_role_name) {
+      return (
+        <AwsAssumedRoleInputs
+          readOnlyFields={[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID]}
+          showAdvancedOptions={!config.linked}
+        />
+      );
     }
 
-    if (config.assume_role_account_id && config.assume_role_name) {
-      return <AwsAssumedRoleInputs readOnlyFields={[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID]} />;
+    if (config.linked) {
+      return <AwsLinkedCredentials />;
     }
 
     return (
diff --git a/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/UpdateDataSourceCredentialsForm.tsx b/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/UpdateDataSourceCredentialsForm.tsx
index 779d5810e..0389580f6 100644
--- a/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/UpdateDataSourceCredentialsForm.tsx
+++ b/ngui/ui/src/components/forms/UpdateDataSourceCredentialsForm/UpdateDataSourceCredentialsForm.tsx
@@ -54,6 +54,14 @@ import { AWS_POOL_UPDATE_DATA_EXPORT_PARAMETERS as AWS_ROOT_UPDATE_DATA_EXPORT_P
 import type { UpdateDataSourceCredentialsFormProps } from "./types";
 
 const getAwsDescription = (config) => {
+  if (config.assume_role_account_id && config.assume_role_name) {
+    return (
+      <Typography sx={{ marginBottom: SPACING_2 }}>
+        <FormattedMessage id="createAwsAssumedRoleDescription" values={{ action: intl.formatMessage({ id: "save" }) }} />
+      </Typography>
+    );
+  }
+
   if (config.linked) {
     return (
       <Typography gutterBottom>
@@ -76,14 +84,6 @@ const getAwsDescription = (config) => {
     );
   }
 
-  if (config.assume_role_account_id && config.assume_role_name) {
-    return (
-      <Typography sx={{ marginBottom: SPACING_2 }}>
-        <FormattedMessage id="createAwsAssumedRoleDescription" values={{ action: intl.formatMessage({ id: "save" }) }} />
-      </Typography>
-    );
-  }
-
   return (
     <Typography gutterBottom component="div">
       <div>
@@ -268,13 +268,6 @@ const getConfig = (type, config) => {
 
       return {
         getDefaultFormValues: () => {
-          if (config.linked) {
-            return {
-              [AWS_LINKED_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID]: config.access_key_id,
-              [AWS_LINKED_CREDENTIALS_FIELD_NAMES.SECRET_ACCESS_KEY]: ""
-            };
-          }
-
           if (config.assume_role_account_id && config.assume_role_name) {
             return {
               [AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID]: config.assume_role_account_id,
@@ -286,6 +279,13 @@ const getConfig = (type, config) => {
             };
           }
 
+          if (config.linked) {
+            return {
+              [AWS_LINKED_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID]: config.access_key_id,
+              [AWS_LINKED_CREDENTIALS_FIELD_NAMES.SECRET_ACCESS_KEY]: ""
+            };
+          }
+
           return {
             [AWS_ROOT_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID]: config.access_key_id,
             [AWS_ROOT_CREDENTIALS_FIELD_NAMES.SECRET_ACCESS_KEY]: "",
@@ -296,6 +296,29 @@ const getConfig = (type, config) => {
           };
         },
         parseFormDataToApiParams: (formData) => {
+          if (config.assume_role_account_id && config.assume_role_name) {
+            return config.linked
+              ? {
+                  config: {
+                    assume_role_account_id: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID],
+                    assume_role_name: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_NAME],
+                    linked: true
+                  }
+                }
+              : {
+                  config: {
+                    assume_role_account_id: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID],
+                    assume_role_name: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_NAME],
+                    config_scheme: AWS_ROOT_CONNECT_CONFIG_SCHEMES.BUCKET_ONLY,
+                    use_edp_discount: formData[AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES.USE_EDP_DISCOUNT],
+                    cur_version: Number(formData[AWS_EXPORT_TYPE_FIELD_NAMES.CUR_VERSION]),
+                    bucket_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.BUCKET_NAME],
+                    report_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.EXPORT_NAME],
+                    region_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.REGION_NAME] || undefined,
+                    bucket_prefix: formData[AWS_BILLING_BUCKET_FIELD_NAMES.BUCKET_PREFIX]
+                  }
+                };
+          }
           if (config.linked) {
             return {
               config: {
@@ -306,22 +329,6 @@ const getConfig = (type, config) => {
             };
           }
 
-          if (config.assume_role_account_id && config.assume_role_name) {
-            return {
-              config: {
-                assume_role_account_id: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_ACCOUNT_ID],
-                assume_role_name: formData[AWS_ROLE_CREDENTIALS_FIELD_NAMES.ASSUME_ROLE_NAME],
-                config_scheme: AWS_ROOT_CONNECT_CONFIG_SCHEMES.BUCKET_ONLY,
-                use_edp_discount: formData[AWS_USE_AWS_EDP_DISCOUNT_FIELD_NAMES.USE_EDP_DISCOUNT],
-                cur_version: Number(formData[AWS_EXPORT_TYPE_FIELD_NAMES.CUR_VERSION]),
-                bucket_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.BUCKET_NAME],
-                report_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.EXPORT_NAME],
-                region_name: formData[AWS_BILLING_BUCKET_FIELD_NAMES.REGION_NAME] || undefined,
-                bucket_prefix: formData[AWS_BILLING_BUCKET_FIELD_NAMES.BUCKET_PREFIX]
-              }
-            };
-          }
-
           return {
             config: {
               access_key_id: formData[AWS_ROOT_CREDENTIALS_FIELD_NAMES.ACCESS_KEY_ID],
diff --git a/ngui/ui/src/containers/ConnectCloudAccountContainer/ConnectCloudAccountContainer.tsx b/ngui/ui/src/containers/ConnectCloudAccountContainer/ConnectCloudAccountContainer.tsx
index 44f7e566c..40e019de5 100644
--- a/ngui/ui/src/containers/ConnectCloudAccountContainer/ConnectCloudAccountContainer.tsx
+++ b/ngui/ui/src/containers/ConnectCloudAccountContainer/ConnectCloudAccountContainer.tsx
@@ -31,14 +31,14 @@ const ConnectCloudAccountContainer = () => {
   const redirectToCloudsOverview = () => navigate(CLOUD_ACCOUNTS);
 
   const getAwsConfigName = (config: Config) => {
-    if (config.linked) {
-      return "awsLinkedConfig";
-    }
-
     if (config.assume_role_account_id && config.assume_role_name) {
       return "awsAssumedRoleConfig";
     }
 
+    if (config.linked) {
+      return "awsLinkedConfig";
+    }
+
     return "awsRootConfig";
   };
 
diff --git a/ngui/ui/src/containers/UpdateDataSourceCredentialsContainer/UpdateDataSourceCredentialsContainer.tsx b/ngui/ui/src/containers/UpdateDataSourceCredentialsContainer/UpdateDataSourceCredentialsContainer.tsx
index 554837569..1fcc22c07 100644
--- a/ngui/ui/src/containers/UpdateDataSourceCredentialsContainer/UpdateDataSourceCredentialsContainer.tsx
+++ b/ngui/ui/src/containers/UpdateDataSourceCredentialsContainer/UpdateDataSourceCredentialsContainer.tsx
@@ -26,14 +26,14 @@ const UpdateDataSourceCredentialsContainer = ({
   const [updateDataSource, { loading }] = useUpdateDataSourceMutation();
 
   const getAwsConfigName = (config: Config) => {
-    if (config.linked) {
-      return "awsLinkedConfig";
-    }
-
     if (config.assume_role_account_id && config.assume_role_name) {
       return "awsAssumedRoleConfig";
     }
 
+    if (config.linked) {
+      return "awsLinkedConfig";
+    }
+
     return "awsRootConfig";
   };
 
diff --git a/ngui/ui/src/graphql/__generated__/hooks/restapi.ts b/ngui/ui/src/graphql/__generated__/hooks/restapi.ts
index fb16dcf7e..9838c3dd0 100644
--- a/ngui/ui/src/graphql/__generated__/hooks/restapi.ts
+++ b/ngui/ui/src/graphql/__generated__/hooks/restapi.ts
@@ -82,6 +82,7 @@ export type AwsAssumedRoleConfigInput = {
   region_name?: InputMaybe<Scalars["String"]["input"]>;
   report_name?: InputMaybe<Scalars["String"]["input"]>;
   use_edp_discount?: InputMaybe<Scalars["Boolean"]["input"]>;
+  linked?: InputMaybe<Scalars["Boolean"]["input"]>;
 };
 
 export type AwsConfig = {
diff --git a/ngui/ui/src/hooks/useIsDataSourceConnectionTypeEnabled.ts b/ngui/ui/src/hooks/useIsDataSourceConnectionTypeEnabled.ts
index 6e6e333b7..aadb553b9 100644
--- a/ngui/ui/src/hooks/useIsDataSourceConnectionTypeEnabled.ts
+++ b/ngui/ui/src/hooks/useIsDataSourceConnectionTypeEnabled.ts
@@ -11,9 +11,8 @@ export const useIsDataSourceConnectionTypeEnabled = () => {
   return useCallback(
     (type: ConnectionType) =>
       ({
-        [CONNECTION_TYPES.AWS_ROLE]: true,
-        [CONNECTION_TYPES.AWS_ROOT]: true,
-        [CONNECTION_TYPES.AWS_LINKED]: true,
+        [CONNECTION_TYPES.AWS_MANAGEMENT]: true,
+        [CONNECTION_TYPES.AWS_MEMBER]: true,
         [CONNECTION_TYPES.AZURE_TENANT]: true,
         [CONNECTION_TYPES.AZURE_SUBSCRIPTION]: true,
         [CONNECTION_TYPES.GCP_TENANT]: true,
diff --git a/ngui/ui/src/translations/en-US/app.json b/ngui/ui/src/translations/en-US/app.json
index 0ae716eac..6e66a86cf 100644
--- a/ngui/ui/src/translations/en-US/app.json
+++ b/ngui/ui/src/translations/en-US/app.json
@@ -47,10 +47,11 @@
   "aboutToStart": "About to start",
   "accept": "Accept",
   "acceptInvitationTitle": "User <strong>{ownerName}</strong> ({ownerEmail}) has invited you to join <strong>{organization}</strong> organization.",
-  "accessKey": "Access key",
-  "accessKeyId": "Access key ID",
+  "accessKey": "Access Key",
+  "accessKeyId": "Access Key ID",
   "accountId": "Account ID",
   "accountManagementTitle": "Account Management",
+  "accountType": "Account Type",
   "acquireWebhook": "Acquire webhook",
   "action": "Action",
   "actions": "Actions",
@@ -178,6 +179,7 @@
   "atLeastOneConditionMustBeMet": "At least <strong>one condition</strong> must be met",
   "atLeastOneInstanceMustBeSelected": "At least one instance must be selected",
   "audit": "Audit",
+  "authentication": "Authentication",
   "authorizedKey": "Authorized key",
   "authorizedKeyId": "Authorized key ID",
   "automatic": "Automatic",
@@ -192,8 +194,10 @@
   "aws": "AWS",
   "awsAccessKeyId": "AWS Access key ID",
   "awsAccessKeyIdTooltip": "Access key ID from IAM user. Can be found on IAM > Users > <i>your_user</i> > Security credentials page on AWS cloud console and in <i>your_user_accessKeys.csv</i> downloaded during access key creation.",
-  "awsAccountType": "AWS account type",
+  "awsAccountType": "AWS Account Type",
   "awsAssumedRoleCredentials": "AWS Assumed Role Credentials",
+  "awsAuthenticationType": "AWS Authentication Type",
+  "awsConnectionType": "AWS Connection Type",
   "awsDataSourcesBackdropMessage": "To get real data, please connect an AWS data source.",
   "awsDataSourcesContactManagerBackdropMessage": "Please contact your organization manager to connect an AWS data source to get real data.",
   "awsLinked": "AWS Linked",
@@ -419,9 +423,14 @@
   "createAnomalyDetectionPolicyTitle": "Create Anomaly Detection Policy",
   "createAutomaticAssignmentRuleBackdropMessage": "Please add an assignment rule to let OptScale automatically assign newly discovered resources to a pool.",
   "createAwsAssumedRoleDescription": "Connection through Assumed Role provides the most modern and secure way to connect OptScale to your AWS account. Please fill the fields below with the necessary information, then click the \"Show Role\" button to get the Assumed Role definition. Once you create the corresponding Role in the AWS Account you're connecting, click the {action} button.",
+  "createAwsDefaultAssumedRoleDocumentationReference1": "We recommend using the Assume Role method to provide access to your AWS account. For more information, please see the <link>documentation</link>.",
+  "createAwsDefaultAssumedRoleDocumentationReference2": "Please provide programmatic credentials for an IAM user with access to resource and billing data.",
+  "createAwsDefaultAssumedRoleDocumentationReference3": "For more information and instructions, see our documentation here: <link></link>",
+  "createAwsDefaultAssumedRoleDocumentationReference4": "Please provide programmatic credentials for an IAM user with access to resource data. AWS member account connections use billing report data from their AWS management account.",
   "createAwsLinkedDocumentationReference1": "AWS Linked Account connection uses billing report data from its AWS Root Account. Please connect a corresponding AWS Root Account according to <autoBillingAwsLink>this guide</autoBillingAwsLink>.",
   "createAwsLinkedDocumentationReference2": "If you do not want to expose billing data of the whole Root Account to OptScale, you can set up data extraction for specific Linked Account using {extractLinkedReports}.",
   "createAwsLinkedDocumentationReference3": "Enter IAM user credentials with <discoverResourcesLink>read-only policy for resource discovery</discoverResourcesLink>.",
+  "createAwsMemberAssumedRoleDescriptions": "Connection through an Assumed Role provides the most modern and secure way to connect FinOps for Cloud to your AWS account. Please fill the fields below with the necessary information, then click the Connect button.",
   "createAwsRootDocumentationReference": "Please provide programmatic credentials for an IAM user with access to billing data. <link>Read this guide</link> for more details.",
   "createAzureSubscriptionDocumentationReference": "Please provide credentials with programmatic read-only access to billing data according to <link>this guide</link>.",
   "createBIExportTitle": "Create Business Intelligence Export",
@@ -1141,6 +1150,7 @@
   "manageVersionPathTitle": "Manage Version Path",
   "manageVersionTagsTitle": "Manage Version Tags",
   "managed": "Managed",
+  "managementStandalone": "Management/Standalone",
   "manager": "Manager",
   "manual": "Manual",
   "markAsEnvironment": "Mark as Shared Environment",
@@ -2189,6 +2199,7 @@
   "stage": "Stage",
   "stages": "Stages",
   "staging": "Staging",
+  "standalone": "Standalone",
   "standardDataExport": "Standard data export (CUR 2.0)",
   "starHystaxOnGithub": "Star hystax/optscale on GitHub",
   "start": "Start",
diff --git a/ngui/ui/src/utils/constants.ts b/ngui/ui/src/utils/constants.ts
index eaa9bcbf3..35461e075 100644
--- a/ngui/ui/src/utils/constants.ts
+++ b/ngui/ui/src/utils/constants.ts
@@ -71,9 +71,8 @@ export const CLOUD_PROVIDERS = Object.freeze({
 });
 
 export const CONNECTION_TYPES = Object.freeze({
-  AWS_ROLE: "awsRole",
-  AWS_ROOT: "awsRoot",
-  AWS_LINKED: "awsLinked",
+  AWS_MANAGEMENT: "awsManagement",
+  AWS_MEMBER: "awsMember",
   AZURE_SUBSCRIPTION: "azureSubscription",
   AZURE_TENANT: "azureTenant",
   ALIBABA: "alibaba",
diff --git a/ngui/ui/vite.config.mts b/ngui/ui/vite.config.mts
index 0395a2295..e8f8a7525 100644
--- a/ngui/ui/vite.config.mts
+++ b/ngui/ui/vite.config.mts
@@ -62,7 +62,9 @@ export default defineConfig(({ mode }) => {
           target: VITE_PROXY,
           changeOrigin: true,
           secure: false,
-          rewrite: (p) => p.replace(/^\/api/, "/")
+          rewrite: (p) => {
+            return p === '/api' ? p : p.replace(/^\/api/, "/");
+          }
         }
       }
     },
diff --git a/rest_api/rest_api_server/controllers/cloud_account.py b/rest_api/rest_api_server/controllers/cloud_account.py
index 3c822b376..7b197dab8 100644
--- a/rest_api/rest_api_server/controllers/cloud_account.py
+++ b/rest_api/rest_api_server/controllers/cloud_account.py
@@ -536,18 +536,21 @@ def edit(self, item_id, **kwargs):
         if cloud_acc_obj.parent_id and config:
             raise WrongArgumentsException(Err.OE0211, ['config'])
         if cloud_acc_type in [CloudTypes.AWS_CNR.value]:
-            role_account_id = old_config.get('assume_role_account_id')
-            old_role = old_config.get('assume_role_name')
-            if role_account_id:
-                new_role_acc = config.get('assume_role_account_id')
-                if new_role_acc and (new_role_acc != role_account_id):
-                    raise WrongArgumentsException(Err.OE0211, [
-                        'assume_role_account_id'])
+            has_assumed_role_data = bool(
+                config.get('assume_role_account_id') or config.get('assume_role_name')
+            )
+            # assumed
+            if has_assumed_role_data:
+                old_role_acc = old_config.get('assume_role_account_id')
+                role_acc = config.get('assume_role_account_id') or old_role_acc
+
+                if old_role_acc and role_acc != old_role_acc:
+                    raise WrongArgumentsException(Err.OE0211, ['assume_role_account_id'])
+
                 role = config.get('assume_role_name')
-                if new_role_acc:
-                    if not role:
-                        raise WrongArgumentsException(Err.OE0548, [
-                            'assume_role_name'])
+                if not role:
+                    raise WrongArgumentsException(Err.OE0548, [
+                        'assume_role_name'])
                 unexpected = ['access_key_id', 'secret_access_key']
                 for i in unexpected:
                     if config.get(i):
@@ -559,11 +562,10 @@ def edit(self, item_id, **kwargs):
                         "access_key_id", "")
                     config["secret_access_key"] = service_creds.get(
                         "secret_access_key", "")
-                    config["assume_role_account_id"] = role_account_id
-                    config["assume_role_name"] = role or old_role
+                    config["assume_role_account_id"] = role_acc
+                    config["assume_role_name"] = role
             # non-assumed
             else:
-
                 access_key_id = config.get('access_key_id')
                 secret_access_key = config.get('secret_access_key')
                 if bool(access_key_id) ^ bool(secret_access_key):
diff --git a/rest_api/rest_api_server/controllers/expense.py b/rest_api/rest_api_server/controllers/expense.py
index d5a470644..4f481b91c 100644
--- a/rest_api/rest_api_server/controllers/expense.py
+++ b/rest_api/rest_api_server/controllers/expense.py
@@ -1746,16 +1746,20 @@ def get_expenses(self, cloud_account_ids, resource_ids, start_date,
             for n, filter_value in enumerate(filter_values):
                 if filter_value == nil_uuid:
                     filter_values[n] = None
-        filters = [
-            {"cloud_account_id": {"$in": cloud_account_ids}},
-            {
-                "$or": [
-                    {"resource_id": {"$in": cloud_resource_ids}},
-                    {"resource_hash": {"$in": cloud_resource_hashes}},
-                ]
-            },
-        ]
-        expenses = list(self.expense_ctrl.get_raw_expenses(start, end, filters))
+        expenses = []
+        for field, list_ids in [
+            ('resource_id', cloud_resource_ids),
+            ('resource_hash', cloud_resource_hashes)
+        ]:
+            if not list_ids:
+                continue
+            filters = [
+                {"cloud_account_id": {"$in": cloud_account_ids}},
+                {field: {"$in": list_ids}},
+            ]
+            expenses.extend(
+                list(self.expense_ctrl.get_raw_expenses(start, end, filters))
+            )
         return expenses, self.get_expenses_total_cost(expenses)
 
     def _get_cloud_resource_ids(self, resource_ids):
diff --git a/rest_api/rest_api_server/controllers/ri_breakdown.py b/rest_api/rest_api_server/controllers/ri_breakdown.py
index 16b8b72d5..021c50846 100644
--- a/rest_api/rest_api_server/controllers/ri_breakdown.py
+++ b/rest_api/rest_api_server/controllers/ri_breakdown.py
@@ -144,7 +144,7 @@ def get_flavors(self, cloud_accounts_map):
                FROM ri_sp_usage
                WHERE cloud_account_id IN cloud_account_ids AND
                  date >= %(start_date)s AND date <= %(end_date)s AND
-                 offer_type='ri'
+                 offer_type='ri' AND instance_type != ''
                """,
             parameters={
                 'start_date': datetime.fromtimestamp(self.start_date),
@@ -176,6 +176,7 @@ def get_flavors(self, cloud_accounts_map):
                     flavor_factor_map[flavor_name] = value
                     cloud_type_flavors[cloud_type].add(flavor_name)
                     break
+            cloud_type_flavors[cloud_type].add(flavor_name)
         return flavor_factor_map, cloud_type_flavors
 
     @staticmethod
@@ -215,13 +216,14 @@ def format_cloud_account(cloud_account_id, cloud_accs_map):
         }
 
     def format_result(self, result, cloud_account_id, date_ts, total_stats,
-                      ri_sp_stats, cloud_accs_map, flavors_map):
+                      ri_sp_stats, cloud_accs_map, cloud_acc_flavor_rate):
         usage = ri_sp_stats.get('usage', 0)
         overprovision_hrs = ri_sp_stats.get('overprovision_hrs', {})
         cost_with_offer = ri_sp_stats.get('cost_with_offer', 0)
         cost_without_offer = ri_sp_stats.get('cost_without_offer', 0)
         for flavor_name, hrs in overprovision_hrs.items():
             overprovision_hrs[flavor_name] = round(hrs, 10)
+        flavors_map = cloud_acc_flavor_rate.get(cloud_account_id, {})
         for flavor in flavors_map:
             if flavor not in overprovision_hrs:
                 overprovision_hrs[flavor] = 0
@@ -245,7 +247,9 @@ def format_result(self, result, cloud_account_id, date_ts, total_stats,
         result[date_ts].append(result_dict)
         return result
 
-    def _empty_stats(self, cloud_account_id, cloud_accs_map, flavors_map):
+    def _empty_stats(self, cloud_account_id, cloud_accs_map,
+                     cloud_acc_flavors_map):
+        flavors_map = cloud_acc_flavors_map.get(cloud_account_id, {})
         result_dict = {
             'cloud_account_id': cloud_account_id,
             'total_usage_hrs': 0,
@@ -264,7 +268,7 @@ def _empty_stats(self, cloud_account_id, cloud_accs_map, flavors_map):
         return result_dict
 
     def fill_empty_dates(self, result, dates, cloud_account_ids, aws_cloud_accs,
-                         flavors_map):
+                         cloud_acc_flavors_map):
         if not cloud_account_ids:
             return result
         for date_ts, date_result in result.items():
@@ -273,11 +277,13 @@ def fill_empty_dates(self, result, dates, cloud_account_ids, aws_cloud_accs,
             cloud_accs_to_fill = set(cloud_account_ids) - date_cloud_accs_ids
             for cloud_acc_id in cloud_accs_to_fill:
                 date_result.append(self._empty_stats(
-                    cloud_acc_id, aws_cloud_accs, flavors_map))
+                    cloud_acc_id, aws_cloud_accs, cloud_acc_flavors_map))
         dates_to_fill = [x for x in dates if x not in result]
         for date in dates_to_fill:
-            result[date] = [self._empty_stats(x, aws_cloud_accs, flavors_map)
-                            for x in cloud_account_ids]
+            result[date] = [
+                self._empty_stats(x, aws_cloud_accs, cloud_acc_flavors_map)
+                for x in cloud_account_ids
+            ]
         return result
 
     def get_overprovision_ch_expenses(
@@ -407,11 +413,11 @@ def get(self, organization_id, **params):
                 ri_stats = date_ri_usage.get(date, {})
                 result = self.format_result(
                     result, cloud_account_id, date_ts, total_stats, ri_stats,
-                    cloud_accs_map, flavor_rate_map)
+                    cloud_accs_map, cloud_acc_flavor_rate)
         breakdown_dates = self.breakdown_dates(self.start_date, self.end_date)
         result = self.fill_empty_dates(
             result, breakdown_dates, cloud_account_ids, cloud_accs_map,
-            flavor_rate_map)
+            cloud_acc_flavor_rate)
         return result
 
 
diff --git a/rest_api/rest_api_server/tests/unittests/test_cloud_accounts.py b/rest_api/rest_api_server/tests/unittests/test_cloud_accounts.py
index 5c13e1518..d5c769e62 100644
--- a/rest_api/rest_api_server/tests/unittests/test_cloud_accounts.py
+++ b/rest_api/rest_api_server/tests/unittests/test_cloud_accounts.py
@@ -189,29 +189,6 @@ def test_create_cloud_key_acc_key(self):
         self.assertEqual(code, 400)
         self.assertEqual(cloud_acc['error']['error_code'], 'OE0548')
 
-    def test_restrict_change_to_assumed(self):
-        valid_config = {
-            'name': 'my cloud_acc',
-            'type': 'aws_cnr',
-            'config': {
-                'access_key_id': 'key',
-                'secret_access_key': 'secret',
-            }
-        }
-        code, cloud_acc = self.create_cloud_account(self.org_id, valid_config)
-        cloud_acc_id = cloud_acc["id"]
-        valid_config.pop('type')
-        # add valid parameter set for assumed account
-        # but restrict changed account type
-        for i in ['assume_role_account_id', 'assume_role_name']:
-            update_cfg = copy.deepcopy(valid_config)
-            update_cfg['config'][i] = ''
-
-            code, cloud_acc = self.client.cloud_account_update(
-                cloud_acc_id, update_cfg)
-            self.assertEqual(code, 400)
-            self.assertEqual(cloud_acc['error']['error_code'], 'OE0212')
-
     def test_create_aws_cloud_acc_assume(self):
         assume_role_account_id = '87629'
         assume_role_name = 'va-test'
@@ -275,6 +252,76 @@ def test_edit_aws_cloud_acc_assume(self, t_schedule):
         self.assertEqual(new_cloud_acc['config']['assume_role_account_id'],
                          config['config']['assume_role_account_id'])
 
+    @patch('rest_api.rest_api_server.controllers.cloud_account.'
+           'ExpensesRecalculationScheduleController.schedule')
+    def test_edit_change_to_assumed(self, t_schedule):
+        valid_config = {
+            'name': 'my cloud_acc',
+            'type': 'aws_cnr',
+            'config': {
+                'access_key_id': 'key',
+                'secret_access_key': 'secret',
+            }
+        }
+        code, cloud_acc = self.create_cloud_account(self.org_id, valid_config)
+        cloud_acc_id = cloud_acc["id"]
+
+        # check service creds account id in config
+        patch('tools.cloud_adapter.clouds.aws.Aws.validate_credentials',
+              return_value={'account_id': cloud_acc_id, 'warnings': []}).start()
+
+        # set valid parameters for an assumed account
+        role_acc_id = '87629'
+        role_acc = 'va-test'
+        assumed_config = {
+            'config': {
+                'assume_role_account_id': role_acc_id,
+                'assume_role_name': role_acc,
+            }
+        }
+        code, cloud_acc = self.client.cloud_account_update(cloud_acc_id, assumed_config)
+        self.assertEqual(code, 200)
+        self.assertEqual(cloud_acc['config']['assume_role_account_id'], role_acc_id)
+        self.assertEqual(cloud_acc['config']['assume_role_name'], role_acc)
+        self.assertEqual(
+            cloud_acc['config']['access_key_id'],
+            self._aws_service_creds['access_key_id'],
+        )
+
+    @patch('rest_api.rest_api_server.controllers.cloud_account.'
+           'ExpensesRecalculationScheduleController.schedule')
+    def test_edit_change_to_access_key(self, t_schedule):
+        config = {
+            'name': 'assume_cloud_acc',
+            'type': 'aws_cnr',
+            'config': {
+                'assume_role_account_id': '87629',
+                'assume_role_name': 'va-test',
+                'config_scheme': 'create_report'
+            }
+        }
+
+        code, cloud_acc = self.create_cloud_account(self.org_id, config)
+        cloud_acc_id = cloud_acc["id"]
+
+        # check service creds account id in config
+        patch('tools.cloud_adapter.clouds.aws.Aws.validate_credentials',
+              return_value={'account_id': cloud_acc_id, 'warnings': []}).start()
+
+        # set valid parameters for an access key
+        key = 'key'
+        secret = 'secret'
+        access_config = {
+            'config': {
+                'access_key_id': key,
+                'secret_access_key': secret,
+            }
+        }
+
+        code, cloud_acc = self.client.cloud_account_update(cloud_acc_id, access_config)
+        self.assertEqual(code, 200)
+        self.assertDictEqual(cloud_acc['config'], {'access_key_id': key})
+
     @patch('rest_api.rest_api_server.controllers.cloud_account.'
            'ExpensesRecalculationScheduleController.schedule')
     def test_edit_assume_restricted_keys(self, t_schedule):
diff --git a/tools/cloud_adapter/clouds/aws.py b/tools/cloud_adapter/clouds/aws.py
index fd0c8b988..6b6126a65 100644
--- a/tools/cloud_adapter/clouds/aws.py
+++ b/tools/cloud_adapter/clouds/aws.py
@@ -78,6 +78,17 @@
     'TooManyRequestsException', 'ProvisionedThroughputExceededException',
 }
 
+TIER_STORAGE_TYPE_MAP = {
+    "STANDARD": "StandardStorage",
+    "STANDARD_IA": "StandardIAStorage",
+    "ONEZONE_IA": "OneZoneIAStorage",
+    "REDUCED_REDUNDANCY": "ReducedRedundancyStorage",
+    "GLACIER": "GlacierStorage",
+    "GLACIER_IR": "GlacierInstantRetrievalStorage",
+    "DEEP_ARCHIVE": "DeepArchiveStorage"
+}
+
+
 def _is_auth_error(exc) -> bool:
 
     if isinstance(exc, ClientError):
@@ -593,7 +604,7 @@ def _get_bucket_public_settings(self, bucket_s3, bucket_name):
         return result
 
     @staticmethod
-    def get_bucket_storage_info(s3_client, bucket_name):
+    def get_bucket_storage_info(cloudwatch, bucket_name):
         """
         Gather storage metadata for a bucket.
         - total_size_bytes (int): aggregated bucket size in bytes.
@@ -601,22 +612,64 @@ def get_bucket_storage_info(s3_client, bucket_name):
         - tiers (dict): aggregated bucket size per storage tier.
         """
 
-        # Filter out directories - only count actual objects
-        def is_actual_object(obj):
-            key = obj.get('Key', '')
-            size = obj.get('Size', 0)
-            return size > 0 or not key.endswith('/')
-
-        paginator = s3_client.get_paginator('list_objects_v2')
-        pages = paginator.paginate(Bucket=bucket_name, Prefix="")
-        obj_count, total_size = 0, 0
-        tiers = defaultdict(float)
-        for page in pages:
-            for obj in page.get("Contents", list()):
-                if is_actual_object(obj):
-                    obj_count += 1
-                    total_size += obj["Size"]
-                    tiers[obj["StorageClass"]] += obj["Size"]
+        end = datetime.now(tz=timezone.utc).replace(
+            hour=0, minute=0, second=0, microsecond=0, tzinfo=None)
+        start = end - timedelta(days=2)
+        queries = []
+        for tier, storage_type in TIER_STORAGE_TYPE_MAP.items():
+            queries.append({
+                "Id": f"size{tier}",
+                "MetricStat": {
+                    "Metric": {
+                        "Namespace": "AWS/S3",
+                        "MetricName": "BucketSizeBytes",
+                        "Dimensions": [
+                            {"Name": "BucketName", "Value": bucket_name},
+                            {"Name": "StorageType", "Value": storage_type},
+                        ],
+                    },
+                    "Period": SECONDS_IN_DAY,
+                    "Stat": "Average",
+                },
+            })
+        queries.append({
+            "Id": "count",
+            "MetricStat": {
+                "Metric": {
+                    "Namespace": "AWS/S3",
+                    "MetricName": "NumberOfObjects",
+                    "Dimensions": [
+                        {"Name": "BucketName", "Value": bucket_name},
+                        {"Name": "StorageType", "Value": "AllStorageTypes"},
+                    ],
+                },
+                "Period": SECONDS_IN_DAY,
+                "Stat": "Average",
+            },
+        })
+        total_size = 0
+        obj_count = 0
+        tiers = defaultdict(int)
+        try:
+            response = cloudwatch.get_metric_data(
+                StartTime=start,
+                EndTime=end,
+                MetricDataQueries=queries,
+                ScanBy="TimestampDescending",
+            )
+            for result in response["MetricDataResults"]:
+                if not result["Values"]:
+                    continue
+                value = int(result["Values"][0])
+                metric_id = result["Id"]
+                if metric_id == "count":
+                    obj_count = value
+                else:
+                    tier = metric_id.removeprefix("size")
+                    tiers[tier] = value
+                    total_size += value
+        except ClientError as exc:
+            LOG.warning(f"Failed to get cloud watch metric: {str(exc)}")
         return {
             bucket_name: {
                 "total_size_bytes": total_size,