For

pulumi preview

, I assume read-only permission to the provider (e.g. aws accounts) should be good enough?

correct, ish

Does

preview

use the provider at all? I've often wondered why it requires the provider, since all it needs (from an outsider's point of view) is to compare the code with the state...

🤔 The only thing that iamlive captured is

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": null,
      "Resource": "*"
    }
  ]
}