diff --git a/src/dns-validated-domain-identity.ts b/src/dns-validated-domain-identity.ts
index 10eade2a..60134054 100644
--- a/src/dns-validated-domain-identity.ts
+++ b/src/dns-validated-domain-identity.ts
@@ -102,7 +102,7 @@ export class DnsValidatedDomainIdentity extends Resource {
     }));
     requestorFunction.addToRolePolicy(new iam.PolicyStatement({
       actions: [
-          "route53:changeResourceRecordSets",
+          "route53:ChangeResourceRecordSets",
           "route53:ListResourceRecordSets",
       ],
       resources: [`arn:${Stack.of(requestorFunction).partition}:route53:::hostedzone/${this.hostedZoneId}`],
diff --git a/test/dns-validated-domain-identitiy.test.ts b/test/dns-validated-domain-identitiy.test.ts
index e404cea4..a92ed5c9 100644
--- a/test/dns-validated-domain-identitiy.test.ts
+++ b/test/dns-validated-domain-identitiy.test.ts
@@ -68,7 +68,7 @@ describe(DnsValidatedDomainIdentity.name, () => {
           },
           {
             Action: [
-              "route53:changeResourceRecordSets",
+              "route53:ChangeResourceRecordSets",
               "route53:ListResourceRecordSets",
             ],
             Effect: "Allow",