Making the "more restrictive policy" even more restrictive

How-to-use-Amazon-Route53-API.md

@@ -53,9 +53,18 @@ If you want to use a much more restrictive AWS policy, use the following:
          "Action": [
             "route53:GetHostedZone",
             "route53:ListResourceRecordSets",
-            "route53:ChangeResourceRecordSets"
          ],
-         "Resource": "arn:aws:route53:::hostedzone/hosted zone id"
+         "Resource": "arn:aws:route53:::hostedzone/<ZONE-ID>"
+      },
+      {
+         "Effect": "Allow",
+         "Action": "route53:ChangeResourceRecordSets",
+         "Resource": "arn:aws:route53:::hostedzone/<ZONE-ID>",
+         "Condition": {
+            "ForAllValues:StringEquals": {
+               "route53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.<SUB>.<DOMAIN>.<TLD>"
+            }
+         }
       }
    ]
 }