Only call FnGetAtt if resource is in acceptable state.

This will give resource type authors some certainty on what error
checking their FnGetAtt methods will require.

Fixes bug: #1184794

Change-Id: Iec456075c14cd609cf9607f07bce23e4c6b33c0c
(cherry picked from commit c19a3deb649b6e4c5ea933e7c0ad157f4049d185
 couple of test fixups required for grizzly backport, notably the
 duplicate create from Id90edd3a09ec15d3814a322ac0b7ec75fd0be54a
 in test_loadbalancer.py is required or the test fails)