diff --git a/images/tidb-backup-manager/Dockerfile b/images/tidb-backup-manager/Dockerfile
index 861490bb88..c7ae4a4caf 100644
--- a/images/tidb-backup-manager/Dockerfile
+++ b/images/tidb-backup-manager/Dockerfile
@@ -1,6 +1,5 @@
 FROM pingcap/tidb-enterprise-tools:latest
-
-ARG VERSION=v1.48.0
+ARG VERSION=v1.51.0
 RUN apk update && apk add ca-certificates
 
 RUN wget -nv https://github.com/ncw/rclone/releases/download/${VERSION}/rclone-${VERSION}-linux-amd64.zip \
diff --git a/manifests/backup/backup-aws-s3-br.yaml b/manifests/backup/backup-aws-s3-br.yaml
new file mode 100644
index 0000000000..fdabe0ba3a
--- /dev/null
+++ b/manifests/backup/backup-aws-s3-br.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: pingcap.com/v1alpha1
+kind: Backup
+metadata:
+  name: demo1-backup-s3
+  namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
+spec:
+  # backupType: full
+  # serviceAccount: myServiceAccount
+  br:
+    cluster: myCluster
+    # clusterNamespce: <backup-namespace>
+    # enableTLSClient: true
+    # logLevel: info
+    # statusAddr: <status-addr>
+    # concurrency: 4
+    # rateLimit: 0
+    # timeAgo: <time>
+    # checksum: true
+    # sendCredToTikv: true
+  from:
+    host: 172.30.6.56
+    secretName: mySecret
+    # port: 4000
+    # user: root
+  s3:
+    provider: aws
+    region: us-west-2
+    bucket: backup
+    prefix: test1-demo1
+    # secretName: aws-secret
diff --git a/manifests/backup/backup-s3-br.yaml b/manifests/backup/backup-s3-br.yaml
index d6a7bbbf60..4513998e49 100644
--- a/manifests/backup/backup-s3-br.yaml
+++ b/manifests/backup/backup-s3-br.yaml
@@ -4,13 +4,15 @@ kind: Backup
 metadata:
   name: demo1-backup-s3
   namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
 spec:
-  #backupType: full
+  # backupType: full
+  # serviceAccount: myServiceAccount
   br:
-    pd: 10.233.40.168:2379
-    # ca: <ca>
-    # cert: <cert>
-    # key: <key>
+    cluster: myCluster
+    # clusterNamespce: <backup-namespace>
+    # enableTLSClient: true
     # logLevel: info
     # statusAddr: <status-addr>
     # concurrency: 4
@@ -18,6 +20,11 @@ spec:
     # timeAgo: <time>
     # checksum: true
     # sendCredToTikv: true
+  from:
+    host: 172.30.6.56
+    secretName: mySecret
+    # port: 4000
+    # user: root
   s3:
     provider: ceph
     endpoint: http://10.233.57.220
diff --git a/manifests/backup/backup-schedule-aws-s3-br.yaml b/manifests/backup/backup-schedule-aws-s3-br.yaml
new file mode 100644
index 0000000000..f950c6cb38
--- /dev/null
+++ b/manifests/backup/backup-schedule-aws-s3-br.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: pingcap.com/v1alpha1
+kind: BackupSchedule
+metadata:
+  name: demo1-backup-schedule-s3
+  namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
+spec:
+  #maxBackups: 5
+  #pause: true
+  maxReservedTime: "3h"
+  schedule: "*/2 * * * *"
+  backupTemplate:
+    #backupType: full
+    # serviceAccount: myServiceAccount
+    br:
+      cluster: myCluster
+      # clusterNamespce: backupNamespace
+      # enableTLSClient:  true
+      # logLevel: info
+      # statusAddr: <status-addr>
+      # concurrency: 4
+      # rateLimit: 0
+      # timeAgo: <time>
+      # checksum: true
+      # sendCredToTikv: true
+    from:
+      host:         172.30.6.56
+      secretName:   mysecret
+      # port:         4000
+      # user:         root
+    s3:
+      provider: aws
+      region: us-west-2
+      bucket: backup
+      prefix: test1-demo1
+      # secretName: aws-secret
diff --git a/manifests/backup/backup-schedule-s3-br.yaml b/manifests/backup/backup-schedule-s3-br.yaml
index 622a7680ae..0fa8e2ba62 100644
--- a/manifests/backup/backup-schedule-s3-br.yaml
+++ b/manifests/backup/backup-schedule-s3-br.yaml
@@ -4,6 +4,8 @@ kind: BackupSchedule
 metadata:
   name: demo1-backup-schedule-s3
   namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
 spec:
   #maxBackups: 5
   #pause: true
@@ -11,11 +13,11 @@ spec:
   schedule: "*/2 * * * *"
   backupTemplate:
     #backupType: full
+    # serviceAccount: myServiceAccount
     br:
-      pd: 10.233.40.168:2379
-      # ca: <ca>
-      # cert: <cert>
-      # key: <key>
+      cluster: myCluster
+      # clusterNamespce: backupNamespace
+      # enableTLSClient:  true
       # logLevel: info
       # statusAddr: <status-addr>
       # concurrency: 4
@@ -23,6 +25,11 @@ spec:
       # timeAgo: <time>
       # checksum: true
       # sendCredToTikv: true
+    from:
+      host:         172.30.6.56
+      secretName:   mysecret
+      # port:         4000
+      # user:         root
     s3:
       provider: ceph
       endpoint: http://10.233.57.220
diff --git a/manifests/backup/restore-aws-s3-br.yaml b/manifests/backup/restore-aws-s3-br.yaml
new file mode 100644
index 0000000000..b9c321fc90
--- /dev/null
+++ b/manifests/backup/restore-aws-s3-br.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: pingcap.com/v1alpha1
+kind: Restore
+metadata:
+  name: demo1-restore-s3-br
+  namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
+spec:
+  # backupType: full
+  # serviceAccount: myServiceAccount
+  br:
+    cluster: myCluster
+    # clusterNamespce: <restore-namespace>
+    # enableTLSClient: true
+    # db: <db-name>
+    # table: <table-name>
+    # logLevel: info
+    # statusAddr: <status-addr>
+    # concurrency: 4
+    # rateLimit: 0
+    # timeAgo: <time>
+    # checksum: true
+    # sendCredToTikv: true
+  to:
+    host: 172.30.6.56
+    secretName: mySecret
+    # port: 4000
+    # user: root
+  s3:
+    provider: aws
+    region: us-west-2
+    bucket: backup
+    prefix: test1-demo1
+    # secretName: aws-secret
diff --git a/manifests/backup/restore-s3-br.yaml b/manifests/backup/restore-s3-br.yaml
index b0d03f1718..e1ef5a8e7c 100644
--- a/manifests/backup/restore-s3-br.yaml
+++ b/manifests/backup/restore-s3-br.yaml
@@ -4,15 +4,17 @@ kind: Restore
 metadata:
   name: demo1-restore-s3-br
   namespace: test1
+  # annotations:
+    # iam.amazonaws.com/role: "arn:aws:iam::123456789:role"
 spec:
   # backupType: full
+  # serviceAccount: myServiceAccount
   br:
-    pd: 10.233.40.168:2379
+    cluster: myCluster
+    # clusterNamespce: <restore-namespace>
+    # enableTLSClient: true
     # db: <db-name>
     # table: <table-name>
-    # ca: <ca>
-    # cert: <cert>
-    # key: <key>
     # logLevel: info
     # statusAddr: <status-addr>
     # concurrency: 4
@@ -20,6 +22,11 @@ spec:
     # timeAgo: <time>
     # checksum: true
     # sendCredToTikv: true
+  to:
+    host: 172.30.6.56
+    secretName: mySecret
+    # port: 4000
+    # user: root
   s3:
     provider: ceph
     endpoint: http://10.233.57.220
diff --git a/manifests/crd.yaml b/manifests/crd.yaml
index f39fb1d36d..5ad1b2b840 100644
--- a/manifests/crd.yaml
+++ b/manifests/crd.yaml
@@ -6896,8 +6896,10 @@ spec:
                   type: string
               required:
               - provider
-              - secretName
               type: object
+            serviceAccount:
+              description: Specify service account of backup
+              type: string
             storageClassName:
               description: The storageClassName of the persistent volume for Backup
                 data storage. Defaults to Kubernetes default storage class.
@@ -7712,8 +7714,10 @@ spec:
                   type: string
               required:
               - provider
-              - secretName
               type: object
+            serviceAccount:
+              description: Specify service account of restore
+              type: string
             storageClassName:
               description: The storageClassName of the persistent volume for Restore
                 data storage. Defaults to Kubernetes default storage class.
@@ -8617,8 +8621,10 @@ spec:
                       type: string
                   required:
                   - provider
-                  - secretName
                   type: object
+                serviceAccount:
+                  description: Specify service account of backup
+                  type: string
                 storageClassName:
                   description: The storageClassName of the persistent volume for Backup
                     data storage. Defaults to Kubernetes default storage class.
diff --git a/pkg/apis/pingcap/v1alpha1/openapi_generated.go b/pkg/apis/pingcap/v1alpha1/openapi_generated.go
index 3626ed2f7f..d47a960349 100644
--- a/pkg/apis/pingcap/v1alpha1/openapi_generated.go
+++ b/pkg/apis/pingcap/v1alpha1/openapi_generated.go
@@ -772,6 +772,13 @@ func schema_pkg_apis_pingcap_v1alpha1_BackupSpec(ref common.ReferenceCallback) c
 							Ref:         ref("k8s.io/api/core/v1.Affinity"),
 						},
 					},
+					"serviceAccount": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Specify service account of backup",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 			},
 		},
@@ -2843,6 +2850,13 @@ func schema_pkg_apis_pingcap_v1alpha1_RestoreSpec(ref common.ReferenceCallback)
 							Ref:         ref("k8s.io/api/core/v1.Affinity"),
 						},
 					},
+					"serviceAccount": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Specify service account of restore",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 			},
 		},
@@ -2929,7 +2943,7 @@ func schema_pkg_apis_pingcap_v1alpha1_S3StorageProvider(ref common.ReferenceCall
 						},
 					},
 				},
-				Required: []string{"provider", "secretName"},
+				Required: []string{"provider"},
 			},
 		},
 	}
diff --git a/pkg/apis/pingcap/v1alpha1/types.go b/pkg/apis/pingcap/v1alpha1/types.go
index 25eb8551df..82363dba05 100644
--- a/pkg/apis/pingcap/v1alpha1/types.go
+++ b/pkg/apis/pingcap/v1alpha1/types.go
@@ -719,7 +719,7 @@ type S3StorageProvider struct {
 	Acl string `json:"acl,omitempty"`
 	// SecretName is the name of secret which stores
 	// S3 compliant storage access key and secret key.
-	SecretName string `json:"secretName"`
+	SecretName string `json:"secretName,omitempty"`
 	// Prefix for the keys.
 	Prefix string `json:"prefix,omitempty"`
 	// SSE Sever-Side Encryption.
@@ -804,6 +804,8 @@ type BackupSpec struct {
 	// Affinity of backup Pods
 	// +optional
 	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+	// Specify service account of backup
+	ServiceAccount string `json:"serviceAccount,omitempty"`
 }
 
 // +k8s:openapi-gen=true
@@ -1022,6 +1024,8 @@ type RestoreSpec struct {
 	// Affinity of restore Pods
 	// +optional
 	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+	// Specify service account of restore
+	ServiceAccount string `json:"serviceAccount,omitempty"`
 }
 
 // RestoreStatus represents the current status of a tidb cluster restore.
diff --git a/pkg/backup/backup/backup_cleaner.go b/pkg/backup/backup/backup_cleaner.go
index 1c9baca499..1f48dce203 100644
--- a/pkg/backup/backup/backup_cleaner.go
+++ b/pkg/backup/backup/backup_cleaner.go
@@ -123,14 +123,19 @@ func (bc *backupCleaner) makeCleanJob(backup *v1alpha1.Backup) (*batchv1.Job, st
 		fmt.Sprintf("--backupName=%s", name),
 	}
 
+	serviceAccount := constants.DefaultServiceAccountName
+	if backup.Spec.ServiceAccount != "" {
+		serviceAccount = backup.Spec.ServiceAccount
+	}
 	backupLabel := label.NewBackup().Instance(backup.GetInstanceName()).CleanJob().Backup(name)
 
 	podSpec := &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels: backupLabel.Labels(),
+			Labels:      backupLabel.Labels(),
+			Annotations: backup.Annotations,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: constants.DefaultServiceAccountName,
+			ServiceAccountName: serviceAccount,
 			Containers: []corev1.Container{
 				{
 					Name:            label.BackupJobLabelVal,
diff --git a/pkg/backup/backup/backup_manager.go b/pkg/backup/backup/backup_manager.go
index 5b9a9b36ed..cc13ee756f 100644
--- a/pkg/backup/backup/backup_manager.go
+++ b/pkg/backup/backup/backup_manager.go
@@ -172,7 +172,6 @@ func (bm *backupManager) makeExportJob(backup *v1alpha1.Backup) (*batchv1.Job, s
 	if err != nil {
 		return nil, reason, fmt.Errorf("backup %s/%s, %v", ns, name, err)
 	}
-
 	envVars = append(envVars, storageEnv...)
 	// TODO: make pvc request storage size configurable
 	reason, err = bm.ensureBackupPVCExist(backup)
@@ -193,14 +192,19 @@ func (bm *backupManager) makeExportJob(backup *v1alpha1.Backup) (*batchv1.Job, s
 		fmt.Sprintf("--storageType=%s", backuputil.GetStorageType(backup.Spec.StorageProvider)),
 	}
 
+	serviceAccount := constants.DefaultServiceAccountName
+	if backup.Spec.ServiceAccount != "" {
+		serviceAccount = backup.Spec.ServiceAccount
+	}
 	backupLabel := label.NewBackup().Instance(backup.GetInstanceName()).BackupJob().Backup(name)
 	// TODO: need add ResourceRequirement for backup job
 	podSpec := &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels: backupLabel.Labels(),
+			Labels:      backupLabel.Labels(),
+			Annotations: backup.Annotations,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: constants.DefaultServiceAccountName,
+			ServiceAccountName: serviceAccount,
 			Containers: []corev1.Container{
 				{
 					Name:            label.BackupJobLabelVal,
@@ -285,12 +289,17 @@ func (bm *backupManager) makeBackupJob(backup *v1alpha1.Backup) (*batchv1.Job, s
 		})
 	}
 
+	serviceAccount := constants.DefaultServiceAccountName
+	if backup.Spec.ServiceAccount != "" {
+		serviceAccount = backup.Spec.ServiceAccount
+	}
 	podSpec := &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels: backupLabel.Labels(),
+			Labels:      backupLabel.Labels(),
+			Annotations: backup.Annotations,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: constants.DefaultServiceAccountName,
+			ServiceAccountName: serviceAccount,
 			Containers: []corev1.Container{
 				{
 					Name:            label.BackupJobLabelVal,
diff --git a/pkg/backup/backupschedule/backup_schedule_manager.go b/pkg/backup/backupschedule/backup_schedule_manager.go
index b27ae240c6..d4eb31a3b5 100644
--- a/pkg/backup/backupschedule/backup_schedule_manager.go
+++ b/pkg/backup/backupschedule/backup_schedule_manager.go
@@ -233,9 +233,10 @@ func (bm *backupScheduleManager) createBackup(bs *v1alpha1.BackupSchedule, times
 	backup := &v1alpha1.Backup{
 		Spec: backupSpec,
 		ObjectMeta: metav1.ObjectMeta{
-			Namespace: ns,
-			Name:      bs.GetBackupCRDName(timestamp),
-			Labels:    bsLabel.Labels(),
+			Namespace:   ns,
+			Name:        bs.GetBackupCRDName(timestamp),
+			Labels:      bsLabel.Labels(),
+			Annotations: bs.Annotations,
 			OwnerReferences: []metav1.OwnerReference{
 				controller.GetBackupScheduleOwnerRef(bs),
 			},
diff --git a/pkg/backup/restore/restore_manager.go b/pkg/backup/restore/restore_manager.go
index 03303b16da..8a07f4a530 100644
--- a/pkg/backup/restore/restore_manager.go
+++ b/pkg/backup/restore/restore_manager.go
@@ -178,14 +178,19 @@ func (rm *restoreManager) makeImportJob(restore *v1alpha1.Restore) (*batchv1.Job
 	}
 
 	restoreLabel := label.NewBackup().Instance(restore.GetInstanceName()).RestoreJob().Restore(name)
+	serviceAccount := constants.DefaultServiceAccountName
+	if restore.Spec.ServiceAccount != "" {
+		serviceAccount = restore.Spec.ServiceAccount
+	}
 
 	// TODO: need add ResourceRequirement for restore job
 	podSpec := &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels: restoreLabel.Labels(),
+			Labels:      restoreLabel.Labels(),
+			Annotations: restore.Annotations,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: constants.DefaultServiceAccountName,
+			ServiceAccountName: serviceAccount,
 			Containers: []corev1.Container{
 				{
 					Name:            label.RestoreJobLabelVal,
@@ -267,13 +272,19 @@ func (rm *restoreManager) makeRestoreJob(restore *v1alpha1.Restore) (*batchv1.Jo
 			},
 		})
 	}
+
+	serviceAccount := constants.DefaultServiceAccountName
+	if restore.Spec.ServiceAccount != "" {
+		serviceAccount = restore.Spec.ServiceAccount
+	}
 	// TODO: need add ResourceRequirement for restore job
 	podSpec := &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels: restoreLabel.Labels(),
+			Labels:      restoreLabel.Labels(),
+			Annotations: restore.Annotations,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: constants.DefaultServiceAccountName,
+			ServiceAccountName: serviceAccount,
 			Containers: []corev1.Container{
 				{
 					Name:            label.RestoreJobLabelVal,
diff --git a/pkg/backup/util/util.go b/pkg/backup/util/util.go
index 86317f53e9..5085fc3897 100644
--- a/pkg/backup/util/util.go
+++ b/pkg/backup/util/util.go
@@ -86,24 +86,28 @@ func GenerateS3CertEnvVar(s3 *v1alpha1.S3StorageProvider) ([]corev1.EnvVar, stri
 			Name:  "AWS_STORAGE_CLASS",
 			Value: s3.StorageClass,
 		},
-		{
-			Name: "AWS_ACCESS_KEY_ID",
-			ValueFrom: &corev1.EnvVarSource{
-				SecretKeyRef: &corev1.SecretKeySelector{
-					LocalObjectReference: corev1.LocalObjectReference{Name: s3.SecretName},
-					Key:                  constants.S3AccessKey,
+	}
+	if s3.SecretName != "" {
+		envVars = append(envVars, []corev1.EnvVar{
+			{
+				Name: "AWS_ACCESS_KEY_ID",
+				ValueFrom: &corev1.EnvVarSource{
+					SecretKeyRef: &corev1.SecretKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{Name: s3.SecretName},
+						Key:                  constants.S3AccessKey,
+					},
 				},
 			},
-		},
-		{
-			Name: "AWS_SECRET_ACCESS_KEY",
-			ValueFrom: &corev1.EnvVarSource{
-				SecretKeyRef: &corev1.SecretKeySelector{
-					LocalObjectReference: corev1.LocalObjectReference{Name: s3.SecretName},
-					Key:                  constants.S3SecretKey,
+			{
+				Name: "AWS_SECRET_ACCESS_KEY",
+				ValueFrom: &corev1.EnvVarSource{
+					SecretKeyRef: &corev1.SecretKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{Name: s3.SecretName},
+						Key:                  constants.S3SecretKey,
+					},
 				},
 			},
-		},
+		}...)
 	}
 	return envVars, "", nil
 }
@@ -151,6 +155,7 @@ func GenerateGcsCertEnvVar(gcs *v1alpha1.GcsStorageProvider) ([]corev1.EnvVar, s
 func GenerateStorageCertEnv(ns string, provider v1alpha1.StorageProvider, secretLister corelisters.SecretLister) ([]corev1.EnvVar, string, error) {
 	var certEnv []corev1.EnvVar
 	var reason string
+	var err error
 	storageType := GetStorageType(provider)
 
 	switch storageType {
@@ -158,17 +163,20 @@ func GenerateStorageCertEnv(ns string, provider v1alpha1.StorageProvider, secret
 		if provider.S3 == nil {
 			return certEnv, "S3ConfigIsEmpty", errors.New("s3 config is empty")
 		}
+
 		s3SecretName := provider.S3.SecretName
-		secret, err := secretLister.Secrets(ns).Get(s3SecretName)
-		if err != nil {
-			err := fmt.Errorf("get s3 secret %s/%s failed, err: %v", ns, s3SecretName, err)
-			return certEnv, "GetS3SecretFailed", err
-		}
+		if s3SecretName != "" {
+			secret, err := secretLister.Secrets(ns).Get(s3SecretName)
+			if err != nil {
+				err := fmt.Errorf("get s3 secret %s/%s failed, err: %v", ns, s3SecretName, err)
+				return certEnv, "GetS3SecretFailed", err
+			}
 
-		keyStr, exist := CheckAllKeysExistInSecret(secret, constants.S3AccessKey, constants.S3SecretKey)
-		if !exist {
-			err := fmt.Errorf("s3 secret %s/%s missing some keys %s", ns, s3SecretName, keyStr)
-			return certEnv, "s3KeyNotExist", err
+			keyStr, exist := CheckAllKeysExistInSecret(secret, constants.S3AccessKey, constants.S3SecretKey)
+			if !exist {
+				err := fmt.Errorf("s3 secret %s/%s missing some keys %s", ns, s3SecretName, keyStr)
+				return certEnv, "s3KeyNotExist", err
+			}
 		}
 
 		certEnv, reason, err = GenerateS3CertEnvVar(provider.S3.DeepCopy())
@@ -218,7 +226,6 @@ func GenerateTidbPasswordEnv(ns, name, tidbSecretName string, secretLister corel
 		err = fmt.Errorf("backup %s/%s, tidb secret %s missing password key %s", ns, name, tidbSecretName, keyStr)
 		return certEnv, "KeyNotExist", err
 	}
-
 	certEnv = []corev1.EnvVar{
 		{
 			Name: fmt.Sprintf("%s_%s", constants.BackupManagerEnvVarPrefix, strings.ToUpper(constants.TidbPasswordKey)),