Follow-up to #445, #445 (comment)

We need validated types for VpcExpose, VpcManifest, VpcTable, or whatever they're called. We'll have to build recursively and cannot simply wrap all of the unchecked types, but it probably doesn't matter in the configuration logic.