The problem is fairly common: my "favourite" is the CertificateValidation resource, that I want to be the parent of a route53 Record: the only reason I'm creating the Record is to satisfy the validation requirement. But I can't. So I've created a ValidCertificate component, which has all three resources (certificate, validation and record) as its children.