ECScape: Understanding IAM Privilege Boundaries in Amazon ECS