Yes but each admin has to use their product (cloud function), configure IAM and do that for every project. This is clearly just a work-around.