cherry pick pingcap#5478 to release-4.0

Signed-off-by: ti-srebot <ti-srebot@pingcap.com>

br/use-br-command-line-tool.md

@@ -201,6 +201,10 @@ If you back up the data to the Amazon S3 backend, instead of `local` storage, yo
 
 You can refer to the [AWS Official Document](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-bucket.html) to create an S3 `Bucket` in the specified `Region`. You can also refer to another [AWS Official Document](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-folder.html) to create a `Folder` in the `Bucket`.
 
+> **Note:**
+>
+> To complete one backup, TiKV and BR usually require the minimum privileges of `s3:ListBucket`, `s3:PutObject`, and `s3:AbortMultipartUpload`.
+
 Pass `SecretKey` and `AccessKey` of the account that has privilege to access the S3 backend to the BR node. Here `SecretKey` and `AccessKey` are passed as environment variables. Then pass the privilege to the TiKV node through BR.
 
 {{< copyable "shell-regular" >}}
@@ -391,6 +395,10 @@ br restore full \
 
 If you restore data from the Amazon S3 backend, instead of `local` storage, you need to specify the S3 storage path in the `storage` sub-command, and allow the BR node and the TiKV node to access Amazon S3.
 
+> **Note:**
+>
+> To complete one restore, TiKV and BR usually require the minimum privileges of `s3:ListBucket` and `s3:GetObject`.
+
 Pass `SecretKey` and `AccessKey` of the account that has privilege to access the S3 backend to the BR node. Here `SecretKey` and `AccessKey` are passed as environment variables. Then pass the privilege to the TiKV node through BR.
 
 {{< copyable "shell-regular" >}}