staging.domain.com. Then you will need to add an NS record to the hosted zone for the production domain with the nameservers that were generated for the staging hosted zone.
wwwCNAME record to each hosted zone pointing to it's primary domain (for certificate validation in the next step).
wwwsubdomain of each of your newly created hosted zones. e.g.
www.staging.domain.com. Follow the Certificat Manager instructions to validate via DNS or email and wait (up to 30 minutes) for the certificates to be issued.
wwwCNAME records you created previously (Terraform will make new ones shortly).