Read-only until you say otherwise.

Connecting a provider for a preview needs read access only. Credentials are encrypted with AWS KMS, decrypted only when a job needs them, and deleted a day after the migration finishes.