Both function and the VMs now are bound to the default compute engine service account. None of them should. As the minimum we should allow passing custom SA names to the module and maybe just create them (module already requires IAM editor privileges).