aws-certificatemanager DnsValidatedCertificateHandler does not properly handle certs with SubjectAlternativeNames

A DnsValidatedCertificate will never successfully validate when SubjectAlternativeNames are present. This seems to be due to the custom resource only adding the first DomainValidationOptions record to Route53. See line 110 here. This should add a new ResourceRecordSet for every DomainValidationOptions result.

Reproduction Steps

Create a DnsValidatedCertificate and add at least one record to subjectAlternativeNames.

Environment

• CLI Version : 1.14.0
• Framework Version: 1.14.0
• OS : MacOS 10.14
• Language : Typescript

---

This is 🐛 Bug Report

[jamiepmullan]

Any updates on this @SomayaB or @rix0rrr ?

[touzoku]

Repro:

const hostedZone = route53.HostedZone.fromLookup(this, 'WebsiteHostedZone', {domainName: 'example.com'})
new acm.DnsValidatedCertificate(
      this,
      'WebsiteCertificate',
      {
        domainName: 'example.com',
        subjectAlternativeNames: ['www.example.com'],
        hostedZone
      }
    )

It will only validate example.com, while www.example.com will be left hanging in ACM until the validator cloudformation custom resource times out.

Submitted a PR fixing this issue: #6516