Don't create the default HTTP listener if we're creating the HTTPS

redirect listener on port 80. Fix IAM permissions when deleting a
tenant.

Author: brtrvn

resources/saas-boost-svc-onboarding.yaml

@@ -652,6 +652,7 @@ Resources:
               - rds:DescribeDBClusterSnapshots
             Resource:
               - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*
+              - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:sb-${Environment}-*tenant*
               - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster-snapshot:*
           - Effect: Allow
             Action:

resources/tenant-onboarding.yaml

@@ -46,6 +46,7 @@ Conditions:
   HasHostedZone: !Not [!Equals [!Ref HostedZoneId, '']]
   HasSubDomainName: !Not [!Equals [!Ref TenantSubDomain, '']]
   HasCertificate: !Not [!Equals [!Ref SSLCertificateArn, '']]
+  NoCertificate: !Equals [!Ref SSLCertificateArn, '']
   CreateSubDomainAlias: !And 
     - !Condition HasDomainName
     - !Condition HasHostedZone
@@ -300,6 +301,7 @@ Resources:
       Protocol: HTTP
   HttpListener:
     Type: AWS::ElasticLoadBalancingV2::Listener
+    Condition: NoCertificate
     Properties:
       LoadBalancerArn: !Ref ApplicationLoadBalancer
       Port: 80