diff --git a/media/tidb-cloud-lake/staging-file.png b/media/tidb-cloud-lake/staging-file.png
index 94f7e25bb12cc..d01e86d4fe7bf 100644
Binary files a/media/tidb-cloud-lake/staging-file.png and b/media/tidb-cloud-lake/staging-file.png differ
diff --git a/tidb-cloud-lake/sql/create-database.md b/tidb-cloud-lake/sql/create-database.md
index 9eaac8bc4c502..cbb19ac3e1ff2 100644
--- a/tidb-cloud-lake/sql/create-database.md
+++ b/tidb-cloud-lake/sql/create-database.md
@@ -39,19 +39,29 @@ To create a database, the user performing the operation or the [current_role](/t
 
 ## Examples
 
+### Creating a Basic Database
+
 The following example creates a database named `test`:
 
 ```sql
 CREATE DATABASE test;
 ```
 
-The following example creates a database with a default storage connection and path:
+### Creating a Database with a Default Storage Connection
+
+The following example creates a connection using an AWS IAM role and then creates a database that uses this connection as its default storage. Using an IAM role is more secure than access keys because it doesn't require storing credentials in {{{ .lake }}}.
 
 ```sql
-CREATE CONNECTION my_s3 STORAGE_TYPE = 's3' ACCESS_KEY_ID = '<key>' SECRET_ACCESS_KEY = '<secret>';
+CREATE CONNECTION my_s3
+    STORAGE_TYPE = 's3'
+    ROLE_ARN = 'arn:aws:iam::987654321987:role/lake-test';
 
 CREATE DATABASE analytics OPTIONS (
     DEFAULT_STORAGE_CONNECTION = 'my_s3',
     DEFAULT_STORAGE_PATH = 's3://mybucket/analytics/'
 );
 ```
+
+> **Note:**
+>
+> To use IAM roles with {{{ .lake }}}, you need to set up a trust relationship between your AWS account and {{{ .lake }}}. See [Authenticate with AWS IAM Role](/tidb-cloud-lake/guides/authenticate-with-aws-iam-role.md) for detailed instructions.