update route 53 policy to be even more restricted

8 years ago · 71ec1e692c
1 changed files with 10 additions and 2 deletions
--- a/README.md
+++ b/README.md
@ -95,12 +95,20 @@ docker run -d \
        {
            "Effect": "Allow",
            "Action": [
-                "route53:ListHostedZonesByName",
-                "route53:ChangeResourceRecordSets"
+                "route53:ListHostedZonesByName"
            ],
            "Resource": [
                "*"
            ]
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "route53:ChangeResourceRecordSets"
+            ],
+            "Resource": [
+                "arn:aws:route53:::hostedzone/${HOSTED_ZONE_ID}"
+            ]
        }
    ]
 }