data "aws_iam_policy_document" "test" {

  statement {
    actions = ["codeartifact:CreateRepository"]
    effect = "Allow"

    principals {
      identifiers = [*]
      type = *
    }
    resources = [aws_codeartifact_domain.example.arn]
  }
}

resource "aws_codeartifact_domain" "example" {
  domain = "example"
  encryption_key = aws_kms_key.example.arn
}

resource "aws_codeartifact_domain_permissions_policy" "test" {
  domain = aws_codeartifact_domain.example.domain
  policy_document = data.aws_iam_policy_document.test.json
}

resource "aws_kms_key" "example" {
  description = "domain key"
}