diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
index 564907523..228976c0f 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
@@ -368,6 +368,7 @@ export interface KeyContextQuery extends ContextLookupRoleOptions {
  * const x: CcApiContextQuery = {
  *   typeName: 'AWS::Some::Type',
  *   expectedMatchCount: 'exactly-one',
+ *   resourceModel: {SomeArn: 'arn:aws:....'},
  *   propertiesToReturn: ['SomeProp'],
  *   account: '11111111111',
  *   region: 'us-east-1',
@@ -390,6 +391,17 @@ export interface CcApiContextQuery extends ContextLookupRoleOptions {
    */
   readonly exactIdentifier?: string;
 
+  /**
+   * The resource model to use to select the resources, using `ListResources`..
+   *
+   * This is needed for sub-resources where the parent Arn is required.
+   *
+   * See https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/resource-operations-list.html#resource-operations-list-containers
+   *
+   * @default - no resource Model is provided
+   */
+  readonly resourceModel?: Record<string, unknown>;
+
   /**
    * Returns any resources matching these properties, using `ListResources`.
    *
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
index 04dba5b96..036731f2d 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
@@ -1093,6 +1093,10 @@
                     "description": "Identifier of the resource to look up using `GetResource`.\n\nSpecifying exactIdentifier will return exactly one result, or throw an error\nunless `ignoreErrorOnMissingContext` is set. (Default - Either exactIdentifier or propertyMatch should be specified.)",
                     "type": "string"
                 },
+                "resourceModel": {
+                    "description": "The resource model to use to select the resources, using `ListResources`..\n\nThis is needed for sub-resources where the parent Arn is required.\n\nSee https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/resource-operations-list.html#resource-operations-list-containers (Default - no resource Model is provided)",
+                    "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+                },
                 "propertyMatch": {
                     "description": "Returns any resources matching these properties, using `ListResources`.\n\nBy default, specifying propertyMatch will successfully return 0 or more\nresults. To throw an error if the number of results is unexpected (and\nprevent the query results from being committed to context), specify\n`expectedMatchCount`.\n\n## Notes on property completeness\n\nCloudControl API's `ListResources` may return fewer properties than\n`GetResource` would, depending on the resource implementation.\n\nThe resources that `propertyMatch` matches against will *only ever* be the\nproperties returned by the `ListResources` call. (Default - Either exactIdentifier or propertyMatch should be specified.)",
                     "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/version.json b/packages/@aws-cdk/cloud-assembly-schema/schema/version.json
index 989abb637..19e41429f 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/schema/version.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/version.json
@@ -1,5 +1,5 @@
 {
-  "schemaHash": "e20bc1d07ab1a891372f40a6d2d8a8eb8e12f828b2b5b90d86b270dcb881ad74",
+  "schemaHash": "c0092c55280aa03c568e1d591f2034783597e942a400d1d58d7f05a8215f51f4",
   "$comment": "Do not hold back the version on additions: jsonschema validation of the manifest by the consumer will trigger errors on unexpected fields.",
-  "revision": 49
+  "revision": 50
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts b/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
index d380f58da..5c5ae3c0f 100644
--- a/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
+++ b/packages/@aws-cdk/toolkit-lib/lib/context-providers/cc-api-provider.ts
@@ -39,7 +39,7 @@ export class CcApiContextProviderPlugin implements ContextProviderPlugin {
         resources = await this.getResource(cloudControl, args.typeName, args.exactIdentifier);
       } else if (args.propertyMatch) {
         // use listResource
-        resources = await this.listResources(cloudControl, args.typeName, args.propertyMatch, args.expectedMatchCount);
+        resources = await this.listResources(cloudControl, args.typeName, args.propertyMatch, args.expectedMatchCount, args.resourceModel);
       } else {
         throw new ContextProviderError(`Provider protocol error: neither exactIdentifier nor propertyMatch is specified in ${JSON.stringify(args)}.`);
       }
@@ -99,14 +99,17 @@ export class CcApiContextProviderPlugin implements ContextProviderPlugin {
     typeName: string,
     propertyMatch: Record<string, unknown>,
     expectedMatchCount?: CcApiContextQuery['expectedMatchCount'],
+    resourceModel?: Record<string, unknown>,
   ): Promise<FoundResource[]> {
     try {
       const found: FoundResource[] = [];
       let nextToken: string | undefined = undefined;
+      const resourceModelJSON: string | undefined = resourceModel ? JSON.stringify(resourceModel) : undefined;
 
       do {
         const result = await cc.listResources({
           TypeName: typeName,
+          ResourceModel: resourceModelJSON,
           MaxResults: 100,
           ...nextToken ? { NextToken: nextToken } : {},
         });