Reduce permissions of IAM roles for ECS cluster

[cdriehuys]

The ECS cluster created in #13 has a lot of very permissive IAM roles that are a side effect of the experimentation that went into provisioning the cluster. These roles should be reduced to the permissions that are actually required.