title: AWS Policy: Allow update specific record in route53 hosted zone
body: <p>Assume the documentation, I should use policy, like this:</p>
  
  <pre><code>{
     "Version": "2017-11-27",
     "Statement":[
        {   
           "Effect":"Allow",
           "Action": [
             "route53:ChangeResourceRecordSets"
           ],  
           "Resource": [
            "arn:aws:route53:::hostedzone/&lt;ZONE_ID&gt;"
           ]
     ]   
  }
  </code></pre>
  
  <p>I need a very safe policy.</p>
  
  <p>I cannot add specific resource record set (one record in zone) in arn.
  I can use <code>Condition</code> to check what record should be changed with <code>ChangeResourceRecordSets</code> API call. If I'm not mistaken.</p>
  
  <p>This is necessary for automatic update only one record in public domain zone. Updates <code>_acme-challenge.ldap.example.com.</code> record for automatically update let's encrypt certificates. I know that <code>acme.sh</code> is available to achive my goal. But I want to write my own custom and simple script to do this.</p>