diff --git a/docs/tutorials/aws.md b/docs/tutorials/aws.md
index 88a7a75a2..e7e20e247 100644
--- a/docs/tutorials/aws.md
+++ b/docs/tutorials/aws.md
@@ -159,6 +159,8 @@ spec:
         - --aws-zone-type=public # only look at public hosted zones (valid values are public, private or no value for both)
         - --registry=txt
         - --txt-owner-id=my-hostedzone-identifier
+      securityContext:
+        fsGroup: 65534 # For ExternalDNS to be able to read Kubernetes and AWS token files
 ```