data "aws_iam_policy_document" "example" {

  statement {
    actions = ["codeartifact:ReadFromRepository"]
    effect = "Allow"

    principals {
      identifiers = [*]
      type = *
    }
    resources = [aws_codeartifact_repository.example.arn]
  }
}

resource "aws_codeartifact_domain" "example" {
  domain = "example"
  encryption_key = aws_kms_key.example.arn
}

resource "aws_codeartifact_repository" "example" {
  domain = aws_codeartifact_domain.example.domain
  repository = "example"
}

resource "aws_codeartifact_repository_permissions_policy" "example" {
  domain = aws_codeartifact_domain.example.domain
  policy_document = data.aws_iam_policy_document.example.json
  repository = aws_codeartifact_repository.example.repository
}

resource "aws_kms_key" "example" {
  description = "domain key"
}