diff --git a/How-to-use-Amazon-Route53-API.md b/How-to-use-Amazon-Route53-API.md
index 8b7cf53..9ed236d 100644
--- a/How-to-use-Amazon-Route53-API.md
+++ b/How-to-use-Amazon-Route53-API.md
@@ -53,9 +53,18 @@ If you want to use a much more restrictive AWS policy, use the following:
          "Action": [
             "route53:GetHostedZone",
             "route53:ListResourceRecordSets",
-            "route53:ChangeResourceRecordSets"
          ],
-         "Resource": "arn:aws:route53:::hostedzone/hosted zone id"
+         "Resource": "arn:aws:route53:::hostedzone/<ZONE-ID>"
+      },
+      {
+         "Effect": "Allow",
+         "Action": "route53:ChangeResourceRecordSets",
+         "Resource": "arn:aws:route53:::hostedzone/<ZONE-ID>",
+         "Condition": {
+            "ForAllValues:StringEquals": {
+               "route53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.<SUB>.<DOMAIN>.<TLD>"
+            }
+         }
       }
    ]
 }