Add serivce account requirement for tiflash pod while restore

en/grant-permissions-to-remote-storage.md

@@ -150,6 +150,12 @@ When you use this method to grant permissions, you can [create the EKS cluster](
 
     Modify the value of `spec.tikv.serviceAccount` to `tidb-backup-manager`. After the TiKV Pod is restarted, check whether the Pod's `serviceAccountName` is changed.
 
+5. (Optional) If your cluster includes TiFlash Pods, repeat step 4 to associate the `ServiceAccount` with the TiFlash Pod.
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **Note:**
 >
 > `arn:aws:iam::123456789012:role/user` is the IAM role created in Step 2.

en/renew-tls-certificate.md

@@ -110,7 +110,7 @@ If the original TLS certificates are issued by [the `cfssl` system](enable-tls-b
 
     > **Note:**
     >
-    >  The above command only renews the server-side and the client-side certificate between PD, TiKV, and TiDB components. If you need to renew the server-side certificates for other components, such as TiCDC, TiFlash and TiProxy, you can execute the similar command.
+    > The above command only renews the server-side and the client-side certificate between PD, TiKV, and TiDB components. If you need to renew the server-side certificates for other components, such as TiCDC, TiFlash and TiProxy, you can execute the similar command.
 
 3. [Perform the rolling restart](restart-a-tidb-cluster.md) to components that need to load the new certificates.
 

zh/grant-permissions-to-remote-storage.md

@@ -148,6 +148,14 @@ kubectl create secret generic s3-secret --from-literal=access_key=xxx --from-lit
 
     将 `spec.tikv.serviceAccount` 修改为 tidb-backup-manager，等到 TiKV Pod 重启后，查看 Pod 的 `serviceAccountName` 是否有变化。
 
+5. (可选)如果集群中包含 TiFlash 节点，重复步骤 4 将 ServiceAccount 绑定到 TiFlash Pod：
+
+    {{< copyable "shell-regular" >}}
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **注意：**
 >
 > `arn:aws:iam::123456789012:role/user` 为步骤 2 中创建的 IAM 角色。