diff --git a/certbot-dns-route53/examples/sample-aws-policy.json b/certbot-dns-route53/examples/sample-aws-policy.json
index 10a17de19..04e8a659c 100644
--- a/certbot-dns-route53/examples/sample-aws-policy.json
+++ b/certbot-dns-route53/examples/sample-aws-policy.json
@@ -19,7 +19,19 @@
             ],
             "Resource" : [
                 "arn:aws:route53:::hostedzone/YOURHOSTEDZONEID"
-            ]
+            ],
+            "Condition": {
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        "_acme-challenge.*"
+                    ]
+                },
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": [
+                        "TXT"
+                    ]
+                }
+            }
         }
     ]
 }