diff --git a/apis/codeartifact/v1beta1/zz_domain_terraformed.go b/apis/codeartifact/v1beta1/zz_domain_terraformed.go
new file mode 100755
index 0000000000..a3cb87e025
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_domain_terraformed.go
@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"dario.cat/mergo"
+	"github.com/pkg/errors"
+
+	"github.com/crossplane/upjet/pkg/resource"
+	"github.com/crossplane/upjet/pkg/resource/json"
+)
+
+// GetTerraformResourceType returns Terraform resource type for this Domain
+func (mg *Domain) GetTerraformResourceType() string {
+	return "aws_codeartifact_domain"
+}
+
+// GetConnectionDetailsMapping for this Domain
+func (tr *Domain) GetConnectionDetailsMapping() map[string]string {
+	return nil
+}
+
+// GetObservation of this Domain
+func (tr *Domain) GetObservation() (map[string]any, error) {
+	o, err := json.TFParser.Marshal(tr.Status.AtProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(o, &base)
+}
+
+// SetObservation for this Domain
+func (tr *Domain) SetObservation(obs map[string]any) error {
+	p, err := json.TFParser.Marshal(obs)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Status.AtProvider)
+}
+
+// GetID returns ID of underlying Terraform resource of this Domain
+func (tr *Domain) GetID() string {
+	if tr.Status.AtProvider.ID == nil {
+		return ""
+	}
+	return *tr.Status.AtProvider.ID
+}
+
+// GetParameters of this Domain
+func (tr *Domain) GetParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.ForProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// SetParameters for this Domain
+func (tr *Domain) SetParameters(params map[string]any) error {
+	p, err := json.TFParser.Marshal(params)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this Domain
+func (tr *Domain) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this Domain
+func (tr *Domain) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this Domain using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *Domain) LateInitialize(attrs []byte) (bool, error) {
+	params := &DomainParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+
+	li := resource.NewGenericLateInitializer(opts...)
+	return li.LateInitialize(&tr.Spec.ForProvider, params)
+}
+
+// GetTerraformSchemaVersion returns the associated Terraform schema version
+func (tr *Domain) GetTerraformSchemaVersion() int {
+	return 0
+}
diff --git a/apis/codeartifact/v1beta1/zz_domain_types.go b/apis/codeartifact/v1beta1/zz_domain_types.go
new file mode 100755
index 0000000000..b6458b496c
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_domain_types.go
@@ -0,0 +1,168 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+type DomainInitParameters struct {
+
+	// The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/kms/v1beta1.Key
+	// +crossplane:generate:reference:extractor=github.com/upbound/provider-aws/config/common.ARNExtractor()
+	EncryptionKey *string `json:"encryptionKey,omitempty" tf:"encryption_key,omitempty"`
+
+	// Reference to a Key in kms to populate encryptionKey.
+	// +kubebuilder:validation:Optional
+	EncryptionKeyRef *v1.Reference `json:"encryptionKeyRef,omitempty" tf:"-"`
+
+	// Selector for a Key in kms to populate encryptionKey.
+	// +kubebuilder:validation:Optional
+	EncryptionKeySelector *v1.Selector `json:"encryptionKeySelector,omitempty" tf:"-"`
+
+	// Key-value map of resource tags.
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+}
+
+type DomainObservation struct {
+
+	// The ARN of the Domain.
+	Arn *string `json:"arn,omitempty" tf:"arn,omitempty"`
+
+	// The total size of all assets in the domain.
+	AssetSizeBytes *string `json:"assetSizeBytes,omitempty" tf:"asset_size_bytes,omitempty"`
+
+	// A timestamp that represents the date and time the domain was created in RFC3339 format.
+	CreatedTime *string `json:"createdTime,omitempty" tf:"created_time,omitempty"`
+
+	// The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
+	EncryptionKey *string `json:"encryptionKey,omitempty" tf:"encryption_key,omitempty"`
+
+	// The ARN of the Domain.
+	ID *string `json:"id,omitempty" tf:"id,omitempty"`
+
+	// The AWS account ID that owns the domain.
+	Owner *string `json:"owner,omitempty" tf:"owner,omitempty"`
+
+	// The number of repositories in the domain.
+	RepositoryCount *float64 `json:"repositoryCount,omitempty" tf:"repository_count,omitempty"`
+
+	// The ARN of the Amazon S3 bucket that is used to store package assets in the domain.
+	S3BucketArn *string `json:"s3BucketArn,omitempty" tf:"s3_bucket_arn,omitempty"`
+
+	// Key-value map of resource tags.
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+
+	// A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
+	// +mapType=granular
+	TagsAll map[string]*string `json:"tagsAll,omitempty" tf:"tags_all,omitempty"`
+}
+
+type DomainParameters struct {
+
+	// The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
+	// +kubebuilder:validation:Optional
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/kms/v1beta1.Key
+	// +crossplane:generate:reference:extractor=github.com/upbound/provider-aws/config/common.ARNExtractor()
+	// +kubebuilder:validation:Optional
+	EncryptionKey *string `json:"encryptionKey,omitempty" tf:"encryption_key,omitempty"`
+
+	// Reference to a Key in kms to populate encryptionKey.
+	// +kubebuilder:validation:Optional
+	EncryptionKeyRef *v1.Reference `json:"encryptionKeyRef,omitempty" tf:"-"`
+
+	// Selector for a Key in kms to populate encryptionKey.
+	// +kubebuilder:validation:Optional
+	EncryptionKeySelector *v1.Selector `json:"encryptionKeySelector,omitempty" tf:"-"`
+
+	// Region is the region you'd like your resource to be created in.
+	// +upjet:crd:field:TFTag=-
+	// +kubebuilder:validation:Required
+	Region *string `json:"region" tf:"-"`
+
+	// Key-value map of resource tags.
+	// +kubebuilder:validation:Optional
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+}
+
+// DomainSpec defines the desired state of Domain
+type DomainSpec struct {
+	v1.ResourceSpec `json:",inline"`
+	ForProvider     DomainParameters `json:"forProvider"`
+	// THIS IS A BETA FIELD. It will be honored
+	// unless the Management Policies feature flag is disabled.
+	// InitProvider holds the same fields as ForProvider, with the exception
+	// of Identifier and other resource reference fields. The fields that are
+	// in InitProvider are merged into ForProvider when the resource is created.
+	// The same fields are also added to the terraform ignore_changes hook, to
+	// avoid updating them after creation. This is useful for fields that are
+	// required on creation, but we do not desire to update them after creation,
+	// for example because of an external controller is managing them, like an
+	// autoscaler.
+	InitProvider DomainInitParameters `json:"initProvider,omitempty"`
+}
+
+// DomainStatus defines the observed state of Domain.
+type DomainStatus struct {
+	v1.ResourceStatus `json:",inline"`
+	AtProvider        DomainObservation `json:"atProvider,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+
+// Domain is the Schema for the Domains API. Provides a CodeArtifact Domain resource.
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,aws}
+type Domain struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.domain) || (has(self.initProvider) && has(self.initProvider.domain))",message="spec.forProvider.domain is a required parameter"
+	Spec   DomainSpec   `json:"spec"`
+	Status DomainStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// DomainList contains a list of Domains
+type DomainList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Domain `json:"items"`
+}
+
+// Repository type metadata.
+var (
+	Domain_Kind             = "Domain"
+	Domain_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: Domain_Kind}.String()
+	Domain_KindAPIVersion   = Domain_Kind + "." + CRDGroupVersion.String()
+	Domain_GroupVersionKind = CRDGroupVersion.WithKind(Domain_Kind)
+)
+
+func init() {
+	SchemeBuilder.Register(&Domain{}, &DomainList{})
+}
diff --git a/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_terraformed.go b/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_terraformed.go
new file mode 100755
index 0000000000..e106fc3200
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_terraformed.go
@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"dario.cat/mergo"
+	"github.com/pkg/errors"
+
+	"github.com/crossplane/upjet/pkg/resource"
+	"github.com/crossplane/upjet/pkg/resource/json"
+)
+
+// GetTerraformResourceType returns Terraform resource type for this DomainPermissionsPolicy
+func (mg *DomainPermissionsPolicy) GetTerraformResourceType() string {
+	return "aws_codeartifact_domain_permissions_policy"
+}
+
+// GetConnectionDetailsMapping for this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetConnectionDetailsMapping() map[string]string {
+	return nil
+}
+
+// GetObservation of this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetObservation() (map[string]any, error) {
+	o, err := json.TFParser.Marshal(tr.Status.AtProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(o, &base)
+}
+
+// SetObservation for this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) SetObservation(obs map[string]any) error {
+	p, err := json.TFParser.Marshal(obs)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Status.AtProvider)
+}
+
+// GetID returns ID of underlying Terraform resource of this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetID() string {
+	if tr.Status.AtProvider.ID == nil {
+		return ""
+	}
+	return *tr.Status.AtProvider.ID
+}
+
+// GetParameters of this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.ForProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// SetParameters for this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) SetParameters(params map[string]any) error {
+	p, err := json.TFParser.Marshal(params)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this DomainPermissionsPolicy
+func (tr *DomainPermissionsPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this DomainPermissionsPolicy using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *DomainPermissionsPolicy) LateInitialize(attrs []byte) (bool, error) {
+	params := &DomainPermissionsPolicyParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+
+	li := resource.NewGenericLateInitializer(opts...)
+	return li.LateInitialize(&tr.Spec.ForProvider, params)
+}
+
+// GetTerraformSchemaVersion returns the associated Terraform schema version
+func (tr *DomainPermissionsPolicy) GetTerraformSchemaVersion() int {
+	return 0
+}
diff --git a/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_types.go b/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_types.go
new file mode 100755
index 0000000000..f4f6010316
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_domainpermissionspolicy_types.go
@@ -0,0 +1,143 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+type DomainPermissionsPolicyInitParameters struct {
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+}
+
+type DomainPermissionsPolicyObservation struct {
+
+	// The name of the domain on which to set the resource policy.
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// The Name of Domain.
+	ID *string `json:"id,omitempty" tf:"id,omitempty"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+
+	// The ARN of the resource associated with the resource policy.
+	ResourceArn *string `json:"resourceArn,omitempty" tf:"resource_arn,omitempty"`
+}
+
+type DomainPermissionsPolicyParameters struct {
+
+	// The name of the domain on which to set the resource policy.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Domain
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)
+	// +kubebuilder:validation:Optional
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	// +kubebuilder:validation:Optional
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// Reference to a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainRef *v1.Reference `json:"domainRef,omitempty" tf:"-"`
+
+	// Selector for a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainSelector *v1.Selector `json:"domainSelector,omitempty" tf:"-"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	// +kubebuilder:validation:Optional
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	// +kubebuilder:validation:Optional
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+
+	// Region is the region you'd like your resource to be created in.
+	// +upjet:crd:field:TFTag=-
+	// +kubebuilder:validation:Required
+	Region *string `json:"region" tf:"-"`
+}
+
+// DomainPermissionsPolicySpec defines the desired state of DomainPermissionsPolicy
+type DomainPermissionsPolicySpec struct {
+	v1.ResourceSpec `json:",inline"`
+	ForProvider     DomainPermissionsPolicyParameters `json:"forProvider"`
+	// THIS IS A BETA FIELD. It will be honored
+	// unless the Management Policies feature flag is disabled.
+	// InitProvider holds the same fields as ForProvider, with the exception
+	// of Identifier and other resource reference fields. The fields that are
+	// in InitProvider are merged into ForProvider when the resource is created.
+	// The same fields are also added to the terraform ignore_changes hook, to
+	// avoid updating them after creation. This is useful for fields that are
+	// required on creation, but we do not desire to update them after creation,
+	// for example because of an external controller is managing them, like an
+	// autoscaler.
+	InitProvider DomainPermissionsPolicyInitParameters `json:"initProvider,omitempty"`
+}
+
+// DomainPermissionsPolicyStatus defines the observed state of DomainPermissionsPolicy.
+type DomainPermissionsPolicyStatus struct {
+	v1.ResourceStatus `json:",inline"`
+	AtProvider        DomainPermissionsPolicyObservation `json:"atProvider,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+
+// DomainPermissionsPolicy is the Schema for the DomainPermissionsPolicys API. Provides a CodeArtifact Domain Permissions Policy resource.
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,aws}
+type DomainPermissionsPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.policyDocument) || (has(self.initProvider) && has(self.initProvider.policyDocument))",message="spec.forProvider.policyDocument is a required parameter"
+	Spec   DomainPermissionsPolicySpec   `json:"spec"`
+	Status DomainPermissionsPolicyStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// DomainPermissionsPolicyList contains a list of DomainPermissionsPolicys
+type DomainPermissionsPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []DomainPermissionsPolicy `json:"items"`
+}
+
+// Repository type metadata.
+var (
+	DomainPermissionsPolicy_Kind             = "DomainPermissionsPolicy"
+	DomainPermissionsPolicy_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: DomainPermissionsPolicy_Kind}.String()
+	DomainPermissionsPolicy_KindAPIVersion   = DomainPermissionsPolicy_Kind + "." + CRDGroupVersion.String()
+	DomainPermissionsPolicy_GroupVersionKind = CRDGroupVersion.WithKind(DomainPermissionsPolicy_Kind)
+)
+
+func init() {
+	SchemeBuilder.Register(&DomainPermissionsPolicy{}, &DomainPermissionsPolicyList{})
+}
diff --git a/apis/codeartifact/v1beta1/zz_generated.conversion_hubs.go b/apis/codeartifact/v1beta1/zz_generated.conversion_hubs.go
new file mode 100755
index 0000000000..2ac7886bae
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_generated.conversion_hubs.go
@@ -0,0 +1,19 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+// Hub marks this type as a conversion hub.
+func (tr *Domain) Hub() {}
+
+// Hub marks this type as a conversion hub.
+func (tr *DomainPermissionsPolicy) Hub() {}
+
+// Hub marks this type as a conversion hub.
+func (tr *Repository) Hub() {}
+
+// Hub marks this type as a conversion hub.
+func (tr *RepositoryPermissionsPolicy) Hub() {}
diff --git a/apis/codeartifact/v1beta1/zz_generated.deepcopy.go b/apis/codeartifact/v1beta1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..8941323370
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_generated.deepcopy.go
@@ -0,0 +1,1239 @@
+//go:build !ignore_autogenerated
+
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"github.com/crossplane/crossplane-runtime/apis/common/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Domain) DeepCopyInto(out *Domain) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Domain.
+func (in *Domain) DeepCopy() *Domain {
+	if in == nil {
+		return nil
+	}
+	out := new(Domain)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Domain) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainInitParameters) DeepCopyInto(out *DomainInitParameters) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.EncryptionKey != nil {
+		in, out := &in.EncryptionKey, &out.EncryptionKey
+		*out = new(string)
+		**out = **in
+	}
+	if in.EncryptionKeyRef != nil {
+		in, out := &in.EncryptionKeyRef, &out.EncryptionKeyRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EncryptionKeySelector != nil {
+		in, out := &in.EncryptionKeySelector, &out.EncryptionKeySelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainInitParameters.
+func (in *DomainInitParameters) DeepCopy() *DomainInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainList) DeepCopyInto(out *DomainList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Domain, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainList.
+func (in *DomainList) DeepCopy() *DomainList {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DomainList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainObservation) DeepCopyInto(out *DomainObservation) {
+	*out = *in
+	if in.Arn != nil {
+		in, out := &in.Arn, &out.Arn
+		*out = new(string)
+		**out = **in
+	}
+	if in.AssetSizeBytes != nil {
+		in, out := &in.AssetSizeBytes, &out.AssetSizeBytes
+		*out = new(string)
+		**out = **in
+	}
+	if in.CreatedTime != nil {
+		in, out := &in.CreatedTime, &out.CreatedTime
+		*out = new(string)
+		**out = **in
+	}
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.EncryptionKey != nil {
+		in, out := &in.EncryptionKey, &out.EncryptionKey
+		*out = new(string)
+		**out = **in
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Owner != nil {
+		in, out := &in.Owner, &out.Owner
+		*out = new(string)
+		**out = **in
+	}
+	if in.RepositoryCount != nil {
+		in, out := &in.RepositoryCount, &out.RepositoryCount
+		*out = new(float64)
+		**out = **in
+	}
+	if in.S3BucketArn != nil {
+		in, out := &in.S3BucketArn, &out.S3BucketArn
+		*out = new(string)
+		**out = **in
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.TagsAll != nil {
+		in, out := &in.TagsAll, &out.TagsAll
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainObservation.
+func (in *DomainObservation) DeepCopy() *DomainObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainParameters) DeepCopyInto(out *DomainParameters) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.EncryptionKey != nil {
+		in, out := &in.EncryptionKey, &out.EncryptionKey
+		*out = new(string)
+		**out = **in
+	}
+	if in.EncryptionKeyRef != nil {
+		in, out := &in.EncryptionKeyRef, &out.EncryptionKeyRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EncryptionKeySelector != nil {
+		in, out := &in.EncryptionKeySelector, &out.EncryptionKeySelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Region != nil {
+		in, out := &in.Region, &out.Region
+		*out = new(string)
+		**out = **in
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainParameters.
+func (in *DomainParameters) DeepCopy() *DomainParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicy) DeepCopyInto(out *DomainPermissionsPolicy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicy.
+func (in *DomainPermissionsPolicy) DeepCopy() *DomainPermissionsPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DomainPermissionsPolicy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicyInitParameters) DeepCopyInto(out *DomainPermissionsPolicyInitParameters) {
+	*out = *in
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicyInitParameters.
+func (in *DomainPermissionsPolicyInitParameters) DeepCopy() *DomainPermissionsPolicyInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicyInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicyList) DeepCopyInto(out *DomainPermissionsPolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]DomainPermissionsPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicyList.
+func (in *DomainPermissionsPolicyList) DeepCopy() *DomainPermissionsPolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DomainPermissionsPolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicyObservation) DeepCopyInto(out *DomainPermissionsPolicyObservation) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+	if in.ResourceArn != nil {
+		in, out := &in.ResourceArn, &out.ResourceArn
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicyObservation.
+func (in *DomainPermissionsPolicyObservation) DeepCopy() *DomainPermissionsPolicyObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicyObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicyParameters) DeepCopyInto(out *DomainPermissionsPolicyParameters) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainRef != nil {
+		in, out := &in.DomainRef, &out.DomainRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DomainSelector != nil {
+		in, out := &in.DomainSelector, &out.DomainSelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+	if in.Region != nil {
+		in, out := &in.Region, &out.Region
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicyParameters.
+func (in *DomainPermissionsPolicyParameters) DeepCopy() *DomainPermissionsPolicyParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicyParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicySpec) DeepCopyInto(out *DomainPermissionsPolicySpec) {
+	*out = *in
+	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+	in.InitProvider.DeepCopyInto(&out.InitProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicySpec.
+func (in *DomainPermissionsPolicySpec) DeepCopy() *DomainPermissionsPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainPermissionsPolicyStatus) DeepCopyInto(out *DomainPermissionsPolicyStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.AtProvider.DeepCopyInto(&out.AtProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainPermissionsPolicyStatus.
+func (in *DomainPermissionsPolicyStatus) DeepCopy() *DomainPermissionsPolicyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainPermissionsPolicyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainSpec) DeepCopyInto(out *DomainSpec) {
+	*out = *in
+	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+	in.InitProvider.DeepCopyInto(&out.InitProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainSpec.
+func (in *DomainSpec) DeepCopy() *DomainSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DomainStatus) DeepCopyInto(out *DomainStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.AtProvider.DeepCopyInto(&out.AtProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainStatus.
+func (in *DomainStatus) DeepCopy() *DomainStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DomainStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalConnectionsInitParameters) DeepCopyInto(out *ExternalConnectionsInitParameters) {
+	*out = *in
+	if in.ExternalConnectionName != nil {
+		in, out := &in.ExternalConnectionName, &out.ExternalConnectionName
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalConnectionsInitParameters.
+func (in *ExternalConnectionsInitParameters) DeepCopy() *ExternalConnectionsInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalConnectionsInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalConnectionsObservation) DeepCopyInto(out *ExternalConnectionsObservation) {
+	*out = *in
+	if in.ExternalConnectionName != nil {
+		in, out := &in.ExternalConnectionName, &out.ExternalConnectionName
+		*out = new(string)
+		**out = **in
+	}
+	if in.PackageFormat != nil {
+		in, out := &in.PackageFormat, &out.PackageFormat
+		*out = new(string)
+		**out = **in
+	}
+	if in.Status != nil {
+		in, out := &in.Status, &out.Status
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalConnectionsObservation.
+func (in *ExternalConnectionsObservation) DeepCopy() *ExternalConnectionsObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalConnectionsObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalConnectionsParameters) DeepCopyInto(out *ExternalConnectionsParameters) {
+	*out = *in
+	if in.ExternalConnectionName != nil {
+		in, out := &in.ExternalConnectionName, &out.ExternalConnectionName
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalConnectionsParameters.
+func (in *ExternalConnectionsParameters) DeepCopy() *ExternalConnectionsParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalConnectionsParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Repository) DeepCopyInto(out *Repository) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Repository.
+func (in *Repository) DeepCopy() *Repository {
+	if in == nil {
+		return nil
+	}
+	out := new(Repository)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Repository) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryInitParameters) DeepCopyInto(out *RepositoryInitParameters) {
+	*out = *in
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExternalConnections != nil {
+		in, out := &in.ExternalConnections, &out.ExternalConnections
+		*out = new(ExternalConnectionsInitParameters)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Repository != nil {
+		in, out := &in.Repository, &out.Repository
+		*out = new(string)
+		**out = **in
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Upstream != nil {
+		in, out := &in.Upstream, &out.Upstream
+		*out = make([]UpstreamInitParameters, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryInitParameters.
+func (in *RepositoryInitParameters) DeepCopy() *RepositoryInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryList) DeepCopyInto(out *RepositoryList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Repository, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryList.
+func (in *RepositoryList) DeepCopy() *RepositoryList {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryObservation) DeepCopyInto(out *RepositoryObservation) {
+	*out = *in
+	if in.AdministratorAccount != nil {
+		in, out := &in.AdministratorAccount, &out.AdministratorAccount
+		*out = new(string)
+		**out = **in
+	}
+	if in.Arn != nil {
+		in, out := &in.Arn, &out.Arn
+		*out = new(string)
+		**out = **in
+	}
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = new(string)
+		**out = **in
+	}
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExternalConnections != nil {
+		in, out := &in.ExternalConnections, &out.ExternalConnections
+		*out = new(ExternalConnectionsObservation)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Repository != nil {
+		in, out := &in.Repository, &out.Repository
+		*out = new(string)
+		**out = **in
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.TagsAll != nil {
+		in, out := &in.TagsAll, &out.TagsAll
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Upstream != nil {
+		in, out := &in.Upstream, &out.Upstream
+		*out = make([]UpstreamObservation, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryObservation.
+func (in *RepositoryObservation) DeepCopy() *RepositoryObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryParameters) DeepCopyInto(out *RepositoryParameters) {
+	*out = *in
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = new(string)
+		**out = **in
+	}
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainRef != nil {
+		in, out := &in.DomainRef, &out.DomainRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DomainSelector != nil {
+		in, out := &in.DomainSelector, &out.DomainSelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExternalConnections != nil {
+		in, out := &in.ExternalConnections, &out.ExternalConnections
+		*out = new(ExternalConnectionsParameters)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Region != nil {
+		in, out := &in.Region, &out.Region
+		*out = new(string)
+		**out = **in
+	}
+	if in.Repository != nil {
+		in, out := &in.Repository, &out.Repository
+		*out = new(string)
+		**out = **in
+	}
+	if in.Tags != nil {
+		in, out := &in.Tags, &out.Tags
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Upstream != nil {
+		in, out := &in.Upstream, &out.Upstream
+		*out = make([]UpstreamParameters, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryParameters.
+func (in *RepositoryParameters) DeepCopy() *RepositoryParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicy) DeepCopyInto(out *RepositoryPermissionsPolicy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicy.
+func (in *RepositoryPermissionsPolicy) DeepCopy() *RepositoryPermissionsPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryPermissionsPolicy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicyInitParameters) DeepCopyInto(out *RepositoryPermissionsPolicyInitParameters) {
+	*out = *in
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicyInitParameters.
+func (in *RepositoryPermissionsPolicyInitParameters) DeepCopy() *RepositoryPermissionsPolicyInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicyInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicyList) DeepCopyInto(out *RepositoryPermissionsPolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]RepositoryPermissionsPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicyList.
+func (in *RepositoryPermissionsPolicyList) DeepCopy() *RepositoryPermissionsPolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RepositoryPermissionsPolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicyObservation) DeepCopyInto(out *RepositoryPermissionsPolicyObservation) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+	if in.Repository != nil {
+		in, out := &in.Repository, &out.Repository
+		*out = new(string)
+		**out = **in
+	}
+	if in.ResourceArn != nil {
+		in, out := &in.ResourceArn, &out.ResourceArn
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicyObservation.
+func (in *RepositoryPermissionsPolicyObservation) DeepCopy() *RepositoryPermissionsPolicyObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicyObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicyParameters) DeepCopyInto(out *RepositoryPermissionsPolicyParameters) {
+	*out = *in
+	if in.Domain != nil {
+		in, out := &in.Domain, &out.Domain
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainOwner != nil {
+		in, out := &in.DomainOwner, &out.DomainOwner
+		*out = new(string)
+		**out = **in
+	}
+	if in.DomainRef != nil {
+		in, out := &in.DomainRef, &out.DomainRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DomainSelector != nil {
+		in, out := &in.DomainSelector, &out.DomainSelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PolicyDocument != nil {
+		in, out := &in.PolicyDocument, &out.PolicyDocument
+		*out = new(string)
+		**out = **in
+	}
+	if in.PolicyRevision != nil {
+		in, out := &in.PolicyRevision, &out.PolicyRevision
+		*out = new(string)
+		**out = **in
+	}
+	if in.Region != nil {
+		in, out := &in.Region, &out.Region
+		*out = new(string)
+		**out = **in
+	}
+	if in.Repository != nil {
+		in, out := &in.Repository, &out.Repository
+		*out = new(string)
+		**out = **in
+	}
+	if in.RepositoryRef != nil {
+		in, out := &in.RepositoryRef, &out.RepositoryRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RepositorySelector != nil {
+		in, out := &in.RepositorySelector, &out.RepositorySelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicyParameters.
+func (in *RepositoryPermissionsPolicyParameters) DeepCopy() *RepositoryPermissionsPolicyParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicyParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicySpec) DeepCopyInto(out *RepositoryPermissionsPolicySpec) {
+	*out = *in
+	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+	in.InitProvider.DeepCopyInto(&out.InitProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicySpec.
+func (in *RepositoryPermissionsPolicySpec) DeepCopy() *RepositoryPermissionsPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryPermissionsPolicyStatus) DeepCopyInto(out *RepositoryPermissionsPolicyStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.AtProvider.DeepCopyInto(&out.AtProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryPermissionsPolicyStatus.
+func (in *RepositoryPermissionsPolicyStatus) DeepCopy() *RepositoryPermissionsPolicyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryPermissionsPolicyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositorySpec) DeepCopyInto(out *RepositorySpec) {
+	*out = *in
+	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+	in.InitProvider.DeepCopyInto(&out.InitProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositorySpec.
+func (in *RepositorySpec) DeepCopy() *RepositorySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositorySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepositoryStatus) DeepCopyInto(out *RepositoryStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.AtProvider.DeepCopyInto(&out.AtProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepositoryStatus.
+func (in *RepositoryStatus) DeepCopy() *RepositoryStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(RepositoryStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpstreamInitParameters) DeepCopyInto(out *UpstreamInitParameters) {
+	*out = *in
+	if in.RepositoryName != nil {
+		in, out := &in.RepositoryName, &out.RepositoryName
+		*out = new(string)
+		**out = **in
+	}
+	if in.RepositoryNameRef != nil {
+		in, out := &in.RepositoryNameRef, &out.RepositoryNameRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RepositoryNameSelector != nil {
+		in, out := &in.RepositoryNameSelector, &out.RepositoryNameSelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpstreamInitParameters.
+func (in *UpstreamInitParameters) DeepCopy() *UpstreamInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(UpstreamInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpstreamObservation) DeepCopyInto(out *UpstreamObservation) {
+	*out = *in
+	if in.RepositoryName != nil {
+		in, out := &in.RepositoryName, &out.RepositoryName
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpstreamObservation.
+func (in *UpstreamObservation) DeepCopy() *UpstreamObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(UpstreamObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpstreamParameters) DeepCopyInto(out *UpstreamParameters) {
+	*out = *in
+	if in.RepositoryName != nil {
+		in, out := &in.RepositoryName, &out.RepositoryName
+		*out = new(string)
+		**out = **in
+	}
+	if in.RepositoryNameRef != nil {
+		in, out := &in.RepositoryNameRef, &out.RepositoryNameRef
+		*out = new(v1.Reference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RepositoryNameSelector != nil {
+		in, out := &in.RepositoryNameSelector, &out.RepositoryNameSelector
+		*out = new(v1.Selector)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpstreamParameters.
+func (in *UpstreamParameters) DeepCopy() *UpstreamParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(UpstreamParameters)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/apis/codeartifact/v1beta1/zz_generated.managed.go b/apis/codeartifact/v1beta1/zz_generated.managed.go
new file mode 100644
index 0000000000..591902f61f
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_generated.managed.go
@@ -0,0 +1,248 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1beta1
+
+import xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+
+// GetCondition of this Domain.
+func (mg *Domain) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetDeletionPolicy of this Domain.
+func (mg *Domain) GetDeletionPolicy() xpv1.DeletionPolicy {
+	return mg.Spec.DeletionPolicy
+}
+
+// GetManagementPolicies of this Domain.
+func (mg *Domain) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this Domain.
+func (mg *Domain) GetProviderConfigReference() *xpv1.Reference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetPublishConnectionDetailsTo of this Domain.
+func (mg *Domain) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
+	return mg.Spec.PublishConnectionDetailsTo
+}
+
+// GetWriteConnectionSecretToReference of this Domain.
+func (mg *Domain) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this Domain.
+func (mg *Domain) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetDeletionPolicy of this Domain.
+func (mg *Domain) SetDeletionPolicy(r xpv1.DeletionPolicy) {
+	mg.Spec.DeletionPolicy = r
+}
+
+// SetManagementPolicies of this Domain.
+func (mg *Domain) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this Domain.
+func (mg *Domain) SetProviderConfigReference(r *xpv1.Reference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetPublishConnectionDetailsTo of this Domain.
+func (mg *Domain) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
+	mg.Spec.PublishConnectionDetailsTo = r
+}
+
+// SetWriteConnectionSecretToReference of this Domain.
+func (mg *Domain) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
+
+// GetCondition of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetDeletionPolicy of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetDeletionPolicy() xpv1.DeletionPolicy {
+	return mg.Spec.DeletionPolicy
+}
+
+// GetManagementPolicies of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetProviderConfigReference() *xpv1.Reference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetPublishConnectionDetailsTo of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
+	return mg.Spec.PublishConnectionDetailsTo
+}
+
+// GetWriteConnectionSecretToReference of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetDeletionPolicy of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetDeletionPolicy(r xpv1.DeletionPolicy) {
+	mg.Spec.DeletionPolicy = r
+}
+
+// SetManagementPolicies of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetProviderConfigReference(r *xpv1.Reference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetPublishConnectionDetailsTo of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
+	mg.Spec.PublishConnectionDetailsTo = r
+}
+
+// SetWriteConnectionSecretToReference of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
+
+// GetCondition of this Repository.
+func (mg *Repository) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetDeletionPolicy of this Repository.
+func (mg *Repository) GetDeletionPolicy() xpv1.DeletionPolicy {
+	return mg.Spec.DeletionPolicy
+}
+
+// GetManagementPolicies of this Repository.
+func (mg *Repository) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this Repository.
+func (mg *Repository) GetProviderConfigReference() *xpv1.Reference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetPublishConnectionDetailsTo of this Repository.
+func (mg *Repository) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
+	return mg.Spec.PublishConnectionDetailsTo
+}
+
+// GetWriteConnectionSecretToReference of this Repository.
+func (mg *Repository) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this Repository.
+func (mg *Repository) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetDeletionPolicy of this Repository.
+func (mg *Repository) SetDeletionPolicy(r xpv1.DeletionPolicy) {
+	mg.Spec.DeletionPolicy = r
+}
+
+// SetManagementPolicies of this Repository.
+func (mg *Repository) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this Repository.
+func (mg *Repository) SetProviderConfigReference(r *xpv1.Reference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetPublishConnectionDetailsTo of this Repository.
+func (mg *Repository) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
+	mg.Spec.PublishConnectionDetailsTo = r
+}
+
+// SetWriteConnectionSecretToReference of this Repository.
+func (mg *Repository) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
+
+// GetCondition of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetDeletionPolicy of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetDeletionPolicy() xpv1.DeletionPolicy {
+	return mg.Spec.DeletionPolicy
+}
+
+// GetManagementPolicies of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetProviderConfigReference() *xpv1.Reference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetPublishConnectionDetailsTo of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
+	return mg.Spec.PublishConnectionDetailsTo
+}
+
+// GetWriteConnectionSecretToReference of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetDeletionPolicy of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetDeletionPolicy(r xpv1.DeletionPolicy) {
+	mg.Spec.DeletionPolicy = r
+}
+
+// SetManagementPolicies of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetProviderConfigReference(r *xpv1.Reference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetPublishConnectionDetailsTo of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
+	mg.Spec.PublishConnectionDetailsTo = r
+}
+
+// SetWriteConnectionSecretToReference of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
diff --git a/apis/codeartifact/v1beta1/zz_generated.managedlist.go b/apis/codeartifact/v1beta1/zz_generated.managedlist.go
new file mode 100644
index 0000000000..3f5457ea32
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_generated.managedlist.go
@@ -0,0 +1,44 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+// Code generated by angryjet. DO NOT EDIT.
+
+package v1beta1
+
+import resource "github.com/crossplane/crossplane-runtime/pkg/resource"
+
+// GetItems of this DomainList.
+func (l *DomainList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
+
+// GetItems of this DomainPermissionsPolicyList.
+func (l *DomainPermissionsPolicyList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
+
+// GetItems of this RepositoryList.
+func (l *RepositoryList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
+
+// GetItems of this RepositoryPermissionsPolicyList.
+func (l *RepositoryPermissionsPolicyList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
diff --git a/apis/codeartifact/v1beta1/zz_generated.resolvers.go b/apis/codeartifact/v1beta1/zz_generated.resolvers.go
new file mode 100644
index 0000000000..d3003decea
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_generated.resolvers.go
@@ -0,0 +1,225 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+// Code generated by angryjet. DO NOT EDIT.
+// Code transformed by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"context"
+	reference "github.com/crossplane/crossplane-runtime/pkg/reference"
+	resource "github.com/crossplane/upjet/pkg/resource"
+	errors "github.com/pkg/errors"
+
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	common "github.com/upbound/provider-aws/config/common"
+	client "sigs.k8s.io/controller-runtime/pkg/client"
+
+	// ResolveReferences of this Domain.
+	apisresolver "github.com/upbound/provider-aws/internal/apis"
+)
+
+func (mg *Domain) ResolveReferences(ctx context.Context, c client.Reader) error {
+	var m xpresource.Managed
+	var l xpresource.ManagedList
+	r := reference.NewAPIResolver(c, mg)
+
+	var rsp reference.ResolutionResponse
+	var err error
+	{
+		m, l, err = apisresolver.GetManagedResource("kms.aws.upbound.io", "v1beta1", "Key", "KeyList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.EncryptionKey),
+			Extract:      common.ARNExtractor(),
+			Reference:    mg.Spec.ForProvider.EncryptionKeyRef,
+			Selector:     mg.Spec.ForProvider.EncryptionKeySelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.ForProvider.EncryptionKey")
+	}
+	mg.Spec.ForProvider.EncryptionKey = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.ForProvider.EncryptionKeyRef = rsp.ResolvedReference
+	{
+		m, l, err = apisresolver.GetManagedResource("kms.aws.upbound.io", "v1beta1", "Key", "KeyList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.InitProvider.EncryptionKey),
+			Extract:      common.ARNExtractor(),
+			Reference:    mg.Spec.InitProvider.EncryptionKeyRef,
+			Selector:     mg.Spec.InitProvider.EncryptionKeySelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.InitProvider.EncryptionKey")
+	}
+	mg.Spec.InitProvider.EncryptionKey = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.InitProvider.EncryptionKeyRef = rsp.ResolvedReference
+
+	return nil
+}
+
+// ResolveReferences of this DomainPermissionsPolicy.
+func (mg *DomainPermissionsPolicy) ResolveReferences(ctx context.Context, c client.Reader) error {
+	var m xpresource.Managed
+	var l xpresource.ManagedList
+	r := reference.NewAPIResolver(c, mg)
+
+	var rsp reference.ResolutionResponse
+	var err error
+	{
+		m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Domain", "DomainList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Domain),
+			Extract:      resource.ExtractParamPath("domain", true),
+			Reference:    mg.Spec.ForProvider.DomainRef,
+			Selector:     mg.Spec.ForProvider.DomainSelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.ForProvider.Domain")
+	}
+	mg.Spec.ForProvider.Domain = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.ForProvider.DomainRef = rsp.ResolvedReference
+
+	return nil
+}
+
+// ResolveReferences of this Repository.
+func (mg *Repository) ResolveReferences(ctx context.Context, c client.Reader) error {
+	var m xpresource.Managed
+	var l xpresource.ManagedList
+	r := reference.NewAPIResolver(c, mg)
+
+	var rsp reference.ResolutionResponse
+	var err error
+	{
+		m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Domain", "DomainList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Domain),
+			Extract:      resource.ExtractParamPath("domain", true),
+			Reference:    mg.Spec.ForProvider.DomainRef,
+			Selector:     mg.Spec.ForProvider.DomainSelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.ForProvider.Domain")
+	}
+	mg.Spec.ForProvider.Domain = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.ForProvider.DomainRef = rsp.ResolvedReference
+
+	for i3 := 0; i3 < len(mg.Spec.ForProvider.Upstream); i3++ {
+		{
+			m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Repository", "RepositoryList")
+			if err != nil {
+				return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+			}
+			rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+				CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Upstream[i3].RepositoryName),
+				Extract:      resource.ExtractParamPath("repository", false),
+				Reference:    mg.Spec.ForProvider.Upstream[i3].RepositoryNameRef,
+				Selector:     mg.Spec.ForProvider.Upstream[i3].RepositoryNameSelector,
+				To:           reference.To{List: l, Managed: m},
+			})
+		}
+		if err != nil {
+			return errors.Wrap(err, "mg.Spec.ForProvider.Upstream[i3].RepositoryName")
+		}
+		mg.Spec.ForProvider.Upstream[i3].RepositoryName = reference.ToPtrValue(rsp.ResolvedValue)
+		mg.Spec.ForProvider.Upstream[i3].RepositoryNameRef = rsp.ResolvedReference
+
+	}
+	for i3 := 0; i3 < len(mg.Spec.InitProvider.Upstream); i3++ {
+		{
+			m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Repository", "RepositoryList")
+			if err != nil {
+				return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+			}
+			rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+				CurrentValue: reference.FromPtrValue(mg.Spec.InitProvider.Upstream[i3].RepositoryName),
+				Extract:      resource.ExtractParamPath("repository", false),
+				Reference:    mg.Spec.InitProvider.Upstream[i3].RepositoryNameRef,
+				Selector:     mg.Spec.InitProvider.Upstream[i3].RepositoryNameSelector,
+				To:           reference.To{List: l, Managed: m},
+			})
+		}
+		if err != nil {
+			return errors.Wrap(err, "mg.Spec.InitProvider.Upstream[i3].RepositoryName")
+		}
+		mg.Spec.InitProvider.Upstream[i3].RepositoryName = reference.ToPtrValue(rsp.ResolvedValue)
+		mg.Spec.InitProvider.Upstream[i3].RepositoryNameRef = rsp.ResolvedReference
+
+	}
+
+	return nil
+}
+
+// ResolveReferences of this RepositoryPermissionsPolicy.
+func (mg *RepositoryPermissionsPolicy) ResolveReferences(ctx context.Context, c client.Reader) error {
+	var m xpresource.Managed
+	var l xpresource.ManagedList
+	r := reference.NewAPIResolver(c, mg)
+
+	var rsp reference.ResolutionResponse
+	var err error
+	{
+		m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Domain", "DomainList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Domain),
+			Extract:      resource.ExtractParamPath("domain", true),
+			Reference:    mg.Spec.ForProvider.DomainRef,
+			Selector:     mg.Spec.ForProvider.DomainSelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.ForProvider.Domain")
+	}
+	mg.Spec.ForProvider.Domain = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.ForProvider.DomainRef = rsp.ResolvedReference
+	{
+		m, l, err = apisresolver.GetManagedResource("codeartifact.aws.upbound.io", "v1beta1", "Repository", "RepositoryList")
+		if err != nil {
+			return errors.Wrap(err, "failed to get the reference target managed resource and its list for reference resolution")
+		}
+
+		rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
+			CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Repository),
+			Extract:      resource.ExtractParamPath("repository", true),
+			Reference:    mg.Spec.ForProvider.RepositoryRef,
+			Selector:     mg.Spec.ForProvider.RepositorySelector,
+			To:           reference.To{List: l, Managed: m},
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "mg.Spec.ForProvider.Repository")
+	}
+	mg.Spec.ForProvider.Repository = reference.ToPtrValue(rsp.ResolvedValue)
+	mg.Spec.ForProvider.RepositoryRef = rsp.ResolvedReference
+
+	return nil
+}
diff --git a/apis/codeartifact/v1beta1/zz_groupversion_info.go b/apis/codeartifact/v1beta1/zz_groupversion_info.go
new file mode 100755
index 0000000000..d2fac8a584
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_groupversion_info.go
@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+// +kubebuilder:object:generate=true
+// +groupName=codeartifact.aws.upbound.io
+// +versionName=v1beta1
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+// Package type metadata.
+const (
+	CRDGroup   = "codeartifact.aws.upbound.io"
+	CRDVersion = "v1beta1"
+)
+
+var (
+	// CRDGroupVersion is the API Group Version used to register the objects
+	CRDGroupVersion = schema.GroupVersion{Group: CRDGroup, Version: CRDVersion}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: CRDGroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
diff --git a/apis/codeartifact/v1beta1/zz_repository_terraformed.go b/apis/codeartifact/v1beta1/zz_repository_terraformed.go
new file mode 100755
index 0000000000..bbceddaf59
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_repository_terraformed.go
@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"dario.cat/mergo"
+	"github.com/pkg/errors"
+
+	"github.com/crossplane/upjet/pkg/resource"
+	"github.com/crossplane/upjet/pkg/resource/json"
+)
+
+// GetTerraformResourceType returns Terraform resource type for this Repository
+func (mg *Repository) GetTerraformResourceType() string {
+	return "aws_codeartifact_repository"
+}
+
+// GetConnectionDetailsMapping for this Repository
+func (tr *Repository) GetConnectionDetailsMapping() map[string]string {
+	return nil
+}
+
+// GetObservation of this Repository
+func (tr *Repository) GetObservation() (map[string]any, error) {
+	o, err := json.TFParser.Marshal(tr.Status.AtProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(o, &base)
+}
+
+// SetObservation for this Repository
+func (tr *Repository) SetObservation(obs map[string]any) error {
+	p, err := json.TFParser.Marshal(obs)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Status.AtProvider)
+}
+
+// GetID returns ID of underlying Terraform resource of this Repository
+func (tr *Repository) GetID() string {
+	if tr.Status.AtProvider.ID == nil {
+		return ""
+	}
+	return *tr.Status.AtProvider.ID
+}
+
+// GetParameters of this Repository
+func (tr *Repository) GetParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.ForProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// SetParameters for this Repository
+func (tr *Repository) SetParameters(params map[string]any) error {
+	p, err := json.TFParser.Marshal(params)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this Repository
+func (tr *Repository) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this Repository
+func (tr *Repository) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this Repository using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *Repository) LateInitialize(attrs []byte) (bool, error) {
+	params := &RepositoryParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+
+	li := resource.NewGenericLateInitializer(opts...)
+	return li.LateInitialize(&tr.Spec.ForProvider, params)
+}
+
+// GetTerraformSchemaVersion returns the associated Terraform schema version
+func (tr *Repository) GetTerraformSchemaVersion() int {
+	return 0
+}
diff --git a/apis/codeartifact/v1beta1/zz_repository_types.go b/apis/codeartifact/v1beta1/zz_repository_types.go
new file mode 100755
index 0000000000..7d59258824
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_repository_types.go
@@ -0,0 +1,245 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+type ExternalConnectionsInitParameters struct {
+
+	// The name of the external connection associated with a repository.
+	ExternalConnectionName *string `json:"externalConnectionName,omitempty" tf:"external_connection_name,omitempty"`
+}
+
+type ExternalConnectionsObservation struct {
+
+	// The name of the external connection associated with a repository.
+	ExternalConnectionName *string `json:"externalConnectionName,omitempty" tf:"external_connection_name,omitempty"`
+
+	PackageFormat *string `json:"packageFormat,omitempty" tf:"package_format,omitempty"`
+
+	Status *string `json:"status,omitempty" tf:"status,omitempty"`
+}
+
+type ExternalConnectionsParameters struct {
+
+	// The name of the external connection associated with a repository.
+	// +kubebuilder:validation:Optional
+	ExternalConnectionName *string `json:"externalConnectionName" tf:"external_connection_name,omitempty"`
+}
+
+type RepositoryInitParameters struct {
+
+	// The description of the repository.
+	Description *string `json:"description,omitempty" tf:"description,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// An array of external connections associated with the repository. Only one external connection can be set per repository. see External Connections.
+	ExternalConnections *ExternalConnectionsInitParameters `json:"externalConnections,omitempty" tf:"external_connections,omitempty"`
+
+	// The name of the repository to create.
+	Repository *string `json:"repository,omitempty" tf:"repository,omitempty"`
+
+	// Key-value map of resource tags.
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+
+	// A list of upstream repositories to associate with the repository. The order of the upstream repositories in the list determines their priority order when AWS CodeArtifact looks for a requested package version. see Upstream
+	Upstream []UpstreamInitParameters `json:"upstream,omitempty" tf:"upstream,omitempty"`
+}
+
+type RepositoryObservation struct {
+
+	// The account number of the AWS account that manages the repository.
+	AdministratorAccount *string `json:"administratorAccount,omitempty" tf:"administrator_account,omitempty"`
+
+	// The ARN of the repository.
+	Arn *string `json:"arn,omitempty" tf:"arn,omitempty"`
+
+	// The description of the repository.
+	Description *string `json:"description,omitempty" tf:"description,omitempty"`
+
+	// The domain that contains the created repository.
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// An array of external connections associated with the repository. Only one external connection can be set per repository. see External Connections.
+	ExternalConnections *ExternalConnectionsObservation `json:"externalConnections,omitempty" tf:"external_connections,omitempty"`
+
+	// The ARN of the repository.
+	ID *string `json:"id,omitempty" tf:"id,omitempty"`
+
+	// The name of the repository to create.
+	Repository *string `json:"repository,omitempty" tf:"repository,omitempty"`
+
+	// Key-value map of resource tags.
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+
+	// A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
+	// +mapType=granular
+	TagsAll map[string]*string `json:"tagsAll,omitempty" tf:"tags_all,omitempty"`
+
+	// A list of upstream repositories to associate with the repository. The order of the upstream repositories in the list determines their priority order when AWS CodeArtifact looks for a requested package version. see Upstream
+	Upstream []UpstreamObservation `json:"upstream,omitempty" tf:"upstream,omitempty"`
+}
+
+type RepositoryParameters struct {
+
+	// The description of the repository.
+	// +kubebuilder:validation:Optional
+	Description *string `json:"description,omitempty" tf:"description,omitempty"`
+
+	// The domain that contains the created repository.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Domain
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)
+	// +kubebuilder:validation:Optional
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	// +kubebuilder:validation:Optional
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// Reference to a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainRef *v1.Reference `json:"domainRef,omitempty" tf:"-"`
+
+	// Selector for a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainSelector *v1.Selector `json:"domainSelector,omitempty" tf:"-"`
+
+	// An array of external connections associated with the repository. Only one external connection can be set per repository. see External Connections.
+	// +kubebuilder:validation:Optional
+	ExternalConnections *ExternalConnectionsParameters `json:"externalConnections,omitempty" tf:"external_connections,omitempty"`
+
+	// Region is the region you'd like your resource to be created in.
+	// +upjet:crd:field:TFTag=-
+	// +kubebuilder:validation:Required
+	Region *string `json:"region" tf:"-"`
+
+	// The name of the repository to create.
+	// +kubebuilder:validation:Optional
+	Repository *string `json:"repository,omitempty" tf:"repository,omitempty"`
+
+	// Key-value map of resource tags.
+	// +kubebuilder:validation:Optional
+	// +mapType=granular
+	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
+
+	// A list of upstream repositories to associate with the repository. The order of the upstream repositories in the list determines their priority order when AWS CodeArtifact looks for a requested package version. see Upstream
+	// +kubebuilder:validation:Optional
+	Upstream []UpstreamParameters `json:"upstream,omitempty" tf:"upstream,omitempty"`
+}
+
+type UpstreamInitParameters struct {
+
+	// The name of an upstream repository.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Repository
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("repository",false)
+	RepositoryName *string `json:"repositoryName,omitempty" tf:"repository_name,omitempty"`
+
+	// Reference to a Repository in codeartifact to populate repositoryName.
+	// +kubebuilder:validation:Optional
+	RepositoryNameRef *v1.Reference `json:"repositoryNameRef,omitempty" tf:"-"`
+
+	// Selector for a Repository in codeartifact to populate repositoryName.
+	// +kubebuilder:validation:Optional
+	RepositoryNameSelector *v1.Selector `json:"repositoryNameSelector,omitempty" tf:"-"`
+}
+
+type UpstreamObservation struct {
+
+	// The name of an upstream repository.
+	RepositoryName *string `json:"repositoryName,omitempty" tf:"repository_name,omitempty"`
+}
+
+type UpstreamParameters struct {
+
+	// The name of an upstream repository.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Repository
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("repository",false)
+	// +kubebuilder:validation:Optional
+	RepositoryName *string `json:"repositoryName,omitempty" tf:"repository_name,omitempty"`
+
+	// Reference to a Repository in codeartifact to populate repositoryName.
+	// +kubebuilder:validation:Optional
+	RepositoryNameRef *v1.Reference `json:"repositoryNameRef,omitempty" tf:"-"`
+
+	// Selector for a Repository in codeartifact to populate repositoryName.
+	// +kubebuilder:validation:Optional
+	RepositoryNameSelector *v1.Selector `json:"repositoryNameSelector,omitempty" tf:"-"`
+}
+
+// RepositorySpec defines the desired state of Repository
+type RepositorySpec struct {
+	v1.ResourceSpec `json:",inline"`
+	ForProvider     RepositoryParameters `json:"forProvider"`
+	// THIS IS A BETA FIELD. It will be honored
+	// unless the Management Policies feature flag is disabled.
+	// InitProvider holds the same fields as ForProvider, with the exception
+	// of Identifier and other resource reference fields. The fields that are
+	// in InitProvider are merged into ForProvider when the resource is created.
+	// The same fields are also added to the terraform ignore_changes hook, to
+	// avoid updating them after creation. This is useful for fields that are
+	// required on creation, but we do not desire to update them after creation,
+	// for example because of an external controller is managing them, like an
+	// autoscaler.
+	InitProvider RepositoryInitParameters `json:"initProvider,omitempty"`
+}
+
+// RepositoryStatus defines the observed state of Repository.
+type RepositoryStatus struct {
+	v1.ResourceStatus `json:",inline"`
+	AtProvider        RepositoryObservation `json:"atProvider,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+
+// Repository is the Schema for the Repositorys API. Provides a CodeArtifact Repository resource.
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,aws}
+type Repository struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.repository) || (has(self.initProvider) && has(self.initProvider.repository))",message="spec.forProvider.repository is a required parameter"
+	Spec   RepositorySpec   `json:"spec"`
+	Status RepositoryStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// RepositoryList contains a list of Repositorys
+type RepositoryList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Repository `json:"items"`
+}
+
+// Repository type metadata.
+var (
+	Repository_Kind             = "Repository"
+	Repository_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: Repository_Kind}.String()
+	Repository_KindAPIVersion   = Repository_Kind + "." + CRDGroupVersion.String()
+	Repository_GroupVersionKind = CRDGroupVersion.WithKind(Repository_Kind)
+)
+
+func init() {
+	SchemeBuilder.Register(&Repository{}, &RepositoryList{})
+}
diff --git a/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_terraformed.go b/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_terraformed.go
new file mode 100755
index 0000000000..37da7c29a1
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_terraformed.go
@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"dario.cat/mergo"
+	"github.com/pkg/errors"
+
+	"github.com/crossplane/upjet/pkg/resource"
+	"github.com/crossplane/upjet/pkg/resource/json"
+)
+
+// GetTerraformResourceType returns Terraform resource type for this RepositoryPermissionsPolicy
+func (mg *RepositoryPermissionsPolicy) GetTerraformResourceType() string {
+	return "aws_codeartifact_repository_permissions_policy"
+}
+
+// GetConnectionDetailsMapping for this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetConnectionDetailsMapping() map[string]string {
+	return nil
+}
+
+// GetObservation of this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetObservation() (map[string]any, error) {
+	o, err := json.TFParser.Marshal(tr.Status.AtProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(o, &base)
+}
+
+// SetObservation for this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) SetObservation(obs map[string]any) error {
+	p, err := json.TFParser.Marshal(obs)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Status.AtProvider)
+}
+
+// GetID returns ID of underlying Terraform resource of this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetID() string {
+	if tr.Status.AtProvider.ID == nil {
+		return ""
+	}
+	return *tr.Status.AtProvider.ID
+}
+
+// GetParameters of this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.ForProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// SetParameters for this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) SetParameters(params map[string]any) error {
+	p, err := json.TFParser.Marshal(params)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this RepositoryPermissionsPolicy
+func (tr *RepositoryPermissionsPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this RepositoryPermissionsPolicy using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *RepositoryPermissionsPolicy) LateInitialize(attrs []byte) (bool, error) {
+	params := &RepositoryPermissionsPolicyParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+
+	li := resource.NewGenericLateInitializer(opts...)
+	return li.LateInitialize(&tr.Spec.ForProvider, params)
+}
+
+// GetTerraformSchemaVersion returns the associated Terraform schema version
+func (tr *RepositoryPermissionsPolicy) GetTerraformSchemaVersion() int {
+	return 0
+}
diff --git a/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_types.go b/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_types.go
new file mode 100755
index 0000000000..fd2d36acb7
--- /dev/null
+++ b/apis/codeartifact/v1beta1/zz_repositorypermissionspolicy_types.go
@@ -0,0 +1,160 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+type RepositoryPermissionsPolicyInitParameters struct {
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+}
+
+type RepositoryPermissionsPolicyObservation struct {
+
+	// The name of the domain on which to set the resource policy.
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// The ARN of the resource associated with the resource policy.
+	ID *string `json:"id,omitempty" tf:"id,omitempty"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+
+	// The name of the repository to set the resource policy on.
+	Repository *string `json:"repository,omitempty" tf:"repository,omitempty"`
+
+	// The ARN of the resource associated with the resource policy.
+	ResourceArn *string `json:"resourceArn,omitempty" tf:"resource_arn,omitempty"`
+}
+
+type RepositoryPermissionsPolicyParameters struct {
+
+	// The name of the domain on which to set the resource policy.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Domain
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)
+	// +kubebuilder:validation:Optional
+	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
+
+	// The account number of the AWS account that owns the domain.
+	// +kubebuilder:validation:Optional
+	DomainOwner *string `json:"domainOwner,omitempty" tf:"domain_owner,omitempty"`
+
+	// Reference to a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainRef *v1.Reference `json:"domainRef,omitempty" tf:"-"`
+
+	// Selector for a Domain in codeartifact to populate domain.
+	// +kubebuilder:validation:Optional
+	DomainSelector *v1.Selector `json:"domainSelector,omitempty" tf:"-"`
+
+	// A JSON policy string to be set as the access control resource policy on the provided domain.
+	// +kubebuilder:validation:Optional
+	PolicyDocument *string `json:"policyDocument,omitempty" tf:"policy_document,omitempty"`
+
+	// The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+	// +kubebuilder:validation:Optional
+	PolicyRevision *string `json:"policyRevision,omitempty" tf:"policy_revision,omitempty"`
+
+	// Region is the region you'd like your resource to be created in.
+	// +upjet:crd:field:TFTag=-
+	// +kubebuilder:validation:Required
+	Region *string `json:"region" tf:"-"`
+
+	// The name of the repository to set the resource policy on.
+	// +crossplane:generate:reference:type=github.com/upbound/provider-aws/apis/codeartifact/v1beta1.Repository
+	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("repository",true)
+	// +kubebuilder:validation:Optional
+	Repository *string `json:"repository,omitempty" tf:"repository,omitempty"`
+
+	// Reference to a Repository in codeartifact to populate repository.
+	// +kubebuilder:validation:Optional
+	RepositoryRef *v1.Reference `json:"repositoryRef,omitempty" tf:"-"`
+
+	// Selector for a Repository in codeartifact to populate repository.
+	// +kubebuilder:validation:Optional
+	RepositorySelector *v1.Selector `json:"repositorySelector,omitempty" tf:"-"`
+}
+
+// RepositoryPermissionsPolicySpec defines the desired state of RepositoryPermissionsPolicy
+type RepositoryPermissionsPolicySpec struct {
+	v1.ResourceSpec `json:",inline"`
+	ForProvider     RepositoryPermissionsPolicyParameters `json:"forProvider"`
+	// THIS IS A BETA FIELD. It will be honored
+	// unless the Management Policies feature flag is disabled.
+	// InitProvider holds the same fields as ForProvider, with the exception
+	// of Identifier and other resource reference fields. The fields that are
+	// in InitProvider are merged into ForProvider when the resource is created.
+	// The same fields are also added to the terraform ignore_changes hook, to
+	// avoid updating them after creation. This is useful for fields that are
+	// required on creation, but we do not desire to update them after creation,
+	// for example because of an external controller is managing them, like an
+	// autoscaler.
+	InitProvider RepositoryPermissionsPolicyInitParameters `json:"initProvider,omitempty"`
+}
+
+// RepositoryPermissionsPolicyStatus defines the observed state of RepositoryPermissionsPolicy.
+type RepositoryPermissionsPolicyStatus struct {
+	v1.ResourceStatus `json:",inline"`
+	AtProvider        RepositoryPermissionsPolicyObservation `json:"atProvider,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+
+// RepositoryPermissionsPolicy is the Schema for the RepositoryPermissionsPolicys API. Provides a CodeArtifact Repository Permissions Policy resource.
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,aws}
+type RepositoryPermissionsPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.policyDocument) || (has(self.initProvider) && has(self.initProvider.policyDocument))",message="spec.forProvider.policyDocument is a required parameter"
+	Spec   RepositoryPermissionsPolicySpec   `json:"spec"`
+	Status RepositoryPermissionsPolicyStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// RepositoryPermissionsPolicyList contains a list of RepositoryPermissionsPolicys
+type RepositoryPermissionsPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RepositoryPermissionsPolicy `json:"items"`
+}
+
+// Repository type metadata.
+var (
+	RepositoryPermissionsPolicy_Kind             = "RepositoryPermissionsPolicy"
+	RepositoryPermissionsPolicy_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: RepositoryPermissionsPolicy_Kind}.String()
+	RepositoryPermissionsPolicy_KindAPIVersion   = RepositoryPermissionsPolicy_Kind + "." + CRDGroupVersion.String()
+	RepositoryPermissionsPolicy_GroupVersionKind = CRDGroupVersion.WithKind(RepositoryPermissionsPolicy_Kind)
+)
+
+func init() {
+	SchemeBuilder.Register(&RepositoryPermissionsPolicy{}, &RepositoryPermissionsPolicyList{})
+}
diff --git a/apis/zz_register.go b/apis/zz_register.go
index ab91fcd102..8ccd9b822b 100755
--- a/apis/zz_register.go
+++ b/apis/zz_register.go
@@ -72,6 +72,7 @@ import (
 	v1beta2cloudwatchevents "github.com/upbound/provider-aws/apis/cloudwatchevents/v1beta2"
 	v1beta1cloudwatchlogs "github.com/upbound/provider-aws/apis/cloudwatchlogs/v1beta1"
 	v1beta2cloudwatchlogs "github.com/upbound/provider-aws/apis/cloudwatchlogs/v1beta2"
+	v1beta1codeartifact "github.com/upbound/provider-aws/apis/codeartifact/v1beta1"
 	v1beta1codecommit "github.com/upbound/provider-aws/apis/codecommit/v1beta1"
 	v1beta1codeguruprofiler "github.com/upbound/provider-aws/apis/codeguruprofiler/v1beta1"
 	v1beta1codepipeline "github.com/upbound/provider-aws/apis/codepipeline/v1beta1"
@@ -364,6 +365,7 @@ func init() {
 		v1beta2cloudwatchevents.SchemeBuilder.AddToScheme,
 		v1beta1cloudwatchlogs.SchemeBuilder.AddToScheme,
 		v1beta2cloudwatchlogs.SchemeBuilder.AddToScheme,
+		v1beta1codeartifact.SchemeBuilder.AddToScheme,
 		v1beta1codecommit.SchemeBuilder.AddToScheme,
 		v1beta1codeguruprofiler.SchemeBuilder.AddToScheme,
 		v1beta1codepipeline.SchemeBuilder.AddToScheme,
diff --git a/cmd/provider/codeartifact/zz_main.go b/cmd/provider/codeartifact/zz_main.go
new file mode 100644
index 0000000000..4c438457ba
--- /dev/null
+++ b/cmd/provider/codeartifact/zz_main.go
@@ -0,0 +1,223 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+
+	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+	"github.com/crossplane/crossplane-runtime/pkg/certificates"
+	xpcontroller "github.com/crossplane/crossplane-runtime/pkg/controller"
+	"github.com/crossplane/crossplane-runtime/pkg/feature"
+	"github.com/crossplane/crossplane-runtime/pkg/logging"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/conversion"
+	"gopkg.in/alecthomas/kingpin.v2"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/tools/leaderelection/resourcelock"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/metrics"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/upbound/provider-aws/apis"
+	"github.com/upbound/provider-aws/apis/v1alpha1"
+	"github.com/upbound/provider-aws/config"
+	resolverapis "github.com/upbound/provider-aws/internal/apis"
+	"github.com/upbound/provider-aws/internal/clients"
+	"github.com/upbound/provider-aws/internal/controller"
+	"github.com/upbound/provider-aws/internal/features"
+)
+
+const (
+	webhookTLSCertDirEnvVar = "WEBHOOK_TLS_CERT_DIR"
+	tlsServerCertDirEnvVar  = "TLS_SERVER_CERTS_DIR"
+	certsDirEnvVar          = "CERTS_DIR"
+	tlsServerCertDir        = "/tls/server"
+)
+
+func deprecationAction(flagName string) kingpin.Action {
+	return func(c *kingpin.ParseContext) error {
+		_, err := fmt.Fprintf(os.Stderr, "warning: Command-line flag %q is deprecated and no longer used. It will be removed in a future release. Please remove it from all of your configurations (ControllerConfigs, etc.).\n", flagName)
+		kingpin.FatalIfError(err, "Failed to print the deprecation notice.")
+		return nil
+	}
+}
+
+func main() {
+	var (
+		app                     = kingpin.New(filepath.Base(os.Args[0]), "AWS support for Crossplane.").DefaultEnvars()
+		debug                   = app.Flag("debug", "Run with debug logging.").Short('d').Bool()
+		syncInterval            = app.Flag("sync", "Sync interval controls how often all resources will be double checked for drift.").Short('s').Default("1h").Duration()
+		pollInterval            = app.Flag("poll", "Poll interval controls how often an individual resource should be checked for drift.").Default("10m").Duration()
+		pollStateMetricInterval = app.Flag("poll-state-metric", "State metric recording interval").Default("5s").Duration()
+		leaderElection          = app.Flag("leader-election", "Use leader election for the controller manager.").Short('l').Default("false").OverrideDefaultFromEnvar("LEADER_ELECTION").Bool()
+		maxReconcileRate        = app.Flag("max-reconcile-rate", "The global maximum rate per second at which resources may be checked for drift from the desired state.").Default("100").Int()
+
+		namespace                  = app.Flag("namespace", "Namespace used to set as default scope in default secret store config.").Default("crossplane-system").Envar("POD_NAMESPACE").String()
+		enableExternalSecretStores = app.Flag("enable-external-secret-stores", "Enable support for ExternalSecretStores.").Default("false").Envar("ENABLE_EXTERNAL_SECRET_STORES").Bool()
+		essTLSCertsPath            = app.Flag("ess-tls-cert-dir", "Path of ESS TLS certificates.").Envar("ESS_TLS_CERTS_DIR").String()
+		enableManagementPolicies   = app.Flag("enable-management-policies", "Enable support for Management Policies.").Default("true").Envar("ENABLE_MANAGEMENT_POLICIES").Bool()
+
+		certsDirSet = false
+		// we record whether the command-line option "--certs-dir" was supplied
+		// in the registered PreAction for the flag.
+		certsDir = app.Flag("certs-dir", "The directory that contains the server key and certificate.").Default(tlsServerCertDir).Envar(certsDirEnvVar).PreAction(func(_ *kingpin.ParseContext) error {
+			certsDirSet = true
+			return nil
+		}).String()
+
+		// now deprecated command-line arguments with the Terraform SDK-based upjet architecture
+		_ = app.Flag("provider-ttl", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] TTL for the native plugin processes before they are replaced. Changing the default may increase memory consumption.").Hidden().Action(deprecationAction("provider-ttl")).Int()
+		_ = app.Flag("terraform-version", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] Terraform version.").Envar("TERRAFORM_VERSION").Hidden().Action(deprecationAction("terraform-version")).String()
+		_ = app.Flag("terraform-provider-version", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] Terraform provider version.").Envar("TERRAFORM_PROVIDER_VERSION").Hidden().Action(deprecationAction("terraform-provider-version")).String()
+		_ = app.Flag("terraform-native-provider-path", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] Terraform native provider path for shared execution.").Envar("TERRAFORM_NATIVE_PROVIDER_PATH").Hidden().Action(deprecationAction("terraform-native-provider-path")).String()
+		_ = app.Flag("terraform-provider-source", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] Terraform provider source.").Envar("TERRAFORM_PROVIDER_SOURCE").Hidden().Action(deprecationAction("terraform-provider-source")).String()
+	)
+	kingpin.MustParse(app.Parse(os.Args[1:]))
+	log.Default().SetOutput(io.Discard)
+	ctrl.SetLogger(zap.New(zap.WriteTo(io.Discard)))
+
+	zl := zap.New(zap.UseDevMode(*debug))
+	logr := logging.NewLogrLogger(zl.WithName("provider-aws"))
+	if *debug {
+		// The controller-runtime runs with a no-op logger by default. It is
+		// *very* verbose even at info level, so we only provide it a real
+		// logger when we're running in debug mode.
+		ctrl.SetLogger(zl)
+	}
+
+	// currently, we configure the jitter to be the 5% of the poll interval
+	pollJitter := time.Duration(float64(*pollInterval) * 0.05)
+	logr.Debug("Starting", "sync-interval", syncInterval.String(),
+		"poll-interval", pollInterval.String(), "poll-jitter", pollJitter, "max-reconcile-rate", *maxReconcileRate)
+
+	cfg, err := ctrl.GetConfig()
+	kingpin.FatalIfError(err, "Cannot get API server rest config")
+
+	// Get the TLS certs directory from the environment variables set by
+	// Crossplane if they're available.
+	// In older XP versions we used WEBHOOK_TLS_CERT_DIR, in newer versions
+	// we use TLS_SERVER_CERTS_DIR. If an explicit certs dir is not supplied
+	// via the command-line options, then these environment variables are used
+	// instead.
+	if !certsDirSet {
+		// backwards-compatibility concerns
+		xpCertsDir := os.Getenv(certsDirEnvVar)
+		if xpCertsDir == "" {
+			xpCertsDir = os.Getenv(tlsServerCertDirEnvVar)
+		}
+		if xpCertsDir == "" {
+			xpCertsDir = os.Getenv(webhookTLSCertDirEnvVar)
+		}
+		// we probably don't need this condition but just to be on the
+		// safe side, if we are missing any kingpin machinery details...
+		if xpCertsDir != "" {
+			*certsDir = xpCertsDir
+		}
+	}
+
+	mgr, err := ctrl.NewManager(ratelimiter.LimitRESTConfig(cfg, *maxReconcileRate), ctrl.Options{
+		LeaderElection:   *leaderElection,
+		LeaderElectionID: "crossplane-leader-election-provider-aws-codeartifact",
+		Cache: cache.Options{
+			SyncPeriod: syncInterval,
+		},
+		WebhookServer: webhook.NewServer(
+			webhook.Options{
+				CertDir: *certsDir,
+			}),
+		LeaderElectionResourceLock: resourcelock.LeasesResourceLock,
+		LeaseDuration:              func() *time.Duration { d := 60 * time.Second; return &d }(),
+		RenewDeadline:              func() *time.Duration { d := 50 * time.Second; return &d }(),
+	})
+	kingpin.FatalIfError(err, "Cannot create controller manager")
+	kingpin.FatalIfError(apis.AddToScheme(mgr.GetScheme()), "Cannot add AWS APIs to scheme")
+	kingpin.FatalIfError(resolverapis.BuildScheme(apis.AddToSchemes), "Cannot register the AWS APIs with the API resolver's runtime scheme")
+
+	metricRecorder := managed.NewMRMetricRecorder()
+	stateMetrics := statemetrics.NewMRStateMetrics()
+
+	metrics.Registry.MustRegister(metricRecorder)
+	metrics.Registry.MustRegister(stateMetrics)
+
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
+	setupConfig := &clients.SetupConfig{
+		Logger:            logr,
+		TerraformProvider: provider.TerraformProvider,
+	}
+	o := tjcontroller.Options{
+		Options: xpcontroller.Options{
+			Logger:                  logr,
+			GlobalRateLimiter:       ratelimiter.NewGlobal(*maxReconcileRate),
+			PollInterval:            *pollInterval,
+			MaxConcurrentReconciles: *maxReconcileRate,
+			Features:                &feature.Flags{},
+			MetricOptions: &xpcontroller.MetricOptions{
+				PollStateMetricInterval: *pollStateMetricInterval,
+				MRMetrics:               metricRecorder,
+				MRStateMetrics:          stateMetrics,
+			},
+		},
+		Provider:              provider,
+		SetupFn:               clients.SelectTerraformSetup(setupConfig),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(logr),
+		StartWebhooks:         *certsDir != "",
+	}
+
+	if *enableManagementPolicies {
+		o.Features.Enable(features.EnableBetaManagementPolicies)
+		logr.Info("Beta feature enabled", "flag", features.EnableBetaManagementPolicies)
+	}
+
+	if *enableExternalSecretStores {
+		o.SecretStoreConfigGVK = &v1alpha1.StoreConfigGroupVersionKind
+		logr.Info("Alpha feature enabled", "flag", features.EnableAlphaExternalSecretStores)
+
+		o.ESSOptions = &tjcontroller.ESSOptions{}
+		if *essTLSCertsPath != "" {
+			logr.Info("ESS TLS certificates path is set. Loading mTLS configuration.")
+			tCfg, err := certificates.LoadMTLSConfig(filepath.Join(*essTLSCertsPath, "ca.crt"), filepath.Join(*essTLSCertsPath, "tls.crt"), filepath.Join(*essTLSCertsPath, "tls.key"), false)
+			kingpin.FatalIfError(err, "Cannot load ESS TLS config.")
+
+			o.ESSOptions.TLSConfig = tCfg
+		}
+
+		// Ensure default store config exists.
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
+			TypeMeta: metav1.TypeMeta{},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "default",
+			},
+			Spec: v1alpha1.StoreConfigSpec{
+				// NOTE(turkenh): We only set required spec and expect optional
+				// ones to properly be initialized with CRD level default values.
+				SecretStoreConfig: xpv1.SecretStoreConfig{
+					DefaultScope: *namespace,
+				},
+			},
+			Status: v1alpha1.StoreConfigStatus{},
+		})), "cannot create default store config")
+	}
+
+	kingpin.FatalIfError(conversion.RegisterConversions(o.Provider), "Cannot initialize the webhook conversion registry")
+	kingpin.FatalIfError(controller.Setup_codeartifact(mgr, o), "Cannot setup AWS controllers")
+	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
+}
diff --git a/config/codeartifact/config.go b/config/codeartifact/config.go
new file mode 100644
index 0000000000..d68b533ae1
--- /dev/null
+++ b/config/codeartifact/config.go
@@ -0,0 +1,47 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: CC0-1.0
+
+package codeartifact
+
+import (
+	"github.com/crossplane/upjet/pkg/config"
+
+	"github.com/upbound/provider-aws/config/common"
+)
+
+// Configure adds configurations for the codeartifact group.
+func Configure(p *config.Provider) {
+	p.AddResourceConfigurator("aws_codeartifact_domain", func(r *config.Resource) {
+		r.References["encryption_key"] = config.Reference{
+			TerraformName: "aws_kms_key",
+			Extractor:     common.PathARNExtractor,
+		}
+	})
+
+	p.AddResourceConfigurator("aws_codeartifact_domain_permissions_policy", func(r *config.Resource) {
+		r.References["domain"] = config.Reference{
+			TerraformName: "aws_codeartifact_domain",
+			Extractor:     `github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)`,
+		}
+	})
+
+	p.AddResourceConfigurator("aws_codeartifact_repository", func(r *config.Resource) {
+		r.References["domain"] = config.Reference{
+			TerraformName: "aws_codeartifact_domain",
+			Extractor:     `github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)`,
+		}
+	})
+
+	p.AddResourceConfigurator("aws_codeartifact_repository_permissions_policy", func(r *config.Resource) {
+		r.References["domain"] = config.Reference{
+			TerraformName: "aws_codeartifact_domain",
+			Extractor:     `github.com/crossplane/upjet/pkg/resource.ExtractParamPath("domain",true)`,
+		}
+
+		r.References["repository"] = config.Reference{
+			TerraformName: "aws_codeartifact_repository",
+			Extractor:     `github.com/crossplane/upjet/pkg/resource.ExtractParamPath("repository",true)`,
+		}
+	})
+}
diff --git a/config/externalname.go b/config/externalname.go
index 80abdf2e54..8e9d7c2623 100644
--- a/config/externalname.go
+++ b/config/externalname.go
@@ -154,6 +154,17 @@ var TerraformPluginSDKExternalNameConfigs = map[string]config.ExternalName{
 	// Event data stores can be imported using their arn
 	"aws_cloudtrail_event_data_store": config.IdentifierFromProvider,
 
+	// codeartifact
+	//
+	// CodeArtifact Domain can be imported using the CodeArtifact Domain arn
+	"aws_codeartifact_domain": config.TemplatedStringAsIdentifier("", "arn:aws:codeartifact:{{ .setup.configuration.region }}:{{ .setup.client_metadata.account_id }}:domain/{{ .external_name }}"),
+	// CodeArtifact Domain Permissions Policies can be imported using the CodeArtifact Domain ARN
+	"aws_codeartifact_domain_permissions_policy": config.TemplatedStringAsIdentifier("", "arn:aws:codeartifact:{{ .setup.configuration.region }}:{{ .setup.client_metadata.account_id }}:domain/{{ .parameters.domain }}"),
+	// CodeArtifact Repository can be imported using the CodeArtifact Repository ARN
+	"aws_codeartifact_repository": config.TemplatedStringAsIdentifier("", "arn:aws:codeartifact:{{ .setup.configuration.region }}:{{ .setup.client_metadata.account_id }}:repository/{{ .parameters.domain }}/{{ .external_name }}"),
+	// CodeArtifact Repository Permissions Policies can be imported using the CodeArtifact Repository ARN
+	"aws_codeartifact_repository_permissions_policy": config.TemplatedStringAsIdentifier("", "arn:aws:codeartifact:{{ .setup.configuration.region }}:{{ .setup.client_metadata.account_id }}:repository/{{ .parameters.domain }}/{{ .parameters.repository }}"),
+
 	// cognitoidentity
 	//
 	// us-west-2_abc123
diff --git a/config/externalnamenottested.go b/config/externalnamenottested.go
index 5d3f39ffe1..765dc95a1f 100644
--- a/config/externalnamenottested.go
+++ b/config/externalnamenottested.go
@@ -56,17 +56,6 @@ var ExternalNameNotTestedConfigs = map[string]config.ExternalName{
 	// HSM modules can be imported using their HSM ID
 	"aws_cloudhsm_v2_hsm": config.IdentifierFromProvider,
 
-	// codeartifact
-	//
-	// CodeArtifact Domain can be imported using the CodeArtifact Domain arn
-	"aws_codeartifact_domain": config.IdentifierFromProvider,
-	// CodeArtifact Domain Permissions Policies can be imported using the CodeArtifact Domain ARN
-	"aws_codeartifact_domain_permissions_policy": config.IdentifierFromProvider,
-	// CodeArtifact Repository can be imported using the CodeArtifact Repository ARN
-	"aws_codeartifact_repository": config.IdentifierFromProvider,
-	// CodeArtifact Repository Permissions Policies can be imported using the CodeArtifact Repository ARN
-	"aws_codeartifact_repository_permissions_policy": config.IdentifierFromProvider,
-
 	// codebuild
 	//
 	// CodeBuild Project can be imported using the name
diff --git a/config/generated.lst b/config/generated.lst
index 4fb69ab319..697c715dc3 100644
--- a/config/generated.lst
+++ b/config/generated.lst
@@ -169,6 +169,10 @@
 "aws_cloudwatch_metric_alarm",
 "aws_cloudwatch_metric_stream",
 "aws_cloudwatch_query_definition",
+"aws_codeartifact_domain",
+"aws_codeartifact_domain_permissions_policy",
+"aws_codeartifact_repository",
+"aws_codeartifact_repository_permissions_policy",
 "aws_codecommit_approval_rule_template",
 "aws_codecommit_approval_rule_template_association",
 "aws_codecommit_repository",
diff --git a/config/provider.go b/config/provider.go
index 1a6639a399..925e88172a 100644
--- a/config/provider.go
+++ b/config/provider.go
@@ -21,6 +21,7 @@ import (
 	"github.com/upbound/provider-aws/config/cloudwatch"
 	"github.com/upbound/provider-aws/config/cloudwatchevents"
 	"github.com/upbound/provider-aws/config/cloudwatchlogs"
+	"github.com/upbound/provider-aws/config/codeartifact"
 	"github.com/upbound/provider-aws/config/cognitoidentity"
 	"github.com/upbound/provider-aws/config/cognitoidp"
 	"github.com/upbound/provider-aws/config/connect"
@@ -107,6 +108,7 @@ func init() {
 	ProviderConfiguration.AddConfig(cloudsearch.Configure)
 	ProviderConfiguration.AddConfig(cloudwatch.Configure)
 	ProviderConfiguration.AddConfig(cloudwatchlogs.Configure)
+	ProviderConfiguration.AddConfig(codeartifact.Configure)
 	ProviderConfiguration.AddConfig(cognitoidentity.Configure)
 	ProviderConfiguration.AddConfig(cognitoidp.Configure)
 	ProviderConfiguration.AddConfig(connect.Configure)
diff --git a/examples-generated/codeartifact/v1beta1/domain.yaml b/examples-generated/codeartifact/v1beta1/domain.yaml
new file mode 100644
index 0000000000..6f5561a37e
--- /dev/null
+++ b/examples-generated/codeartifact/v1beta1/domain.yaml
@@ -0,0 +1,12 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domain
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domain: example
+    region: us-west-1
diff --git a/examples-generated/codeartifact/v1beta1/domainpermissionspolicy.yaml b/examples-generated/codeartifact/v1beta1/domainpermissionspolicy.yaml
new file mode 100644
index 0000000000..0d488597e4
--- /dev/null
+++ b/examples-generated/codeartifact/v1beta1/domainpermissionspolicy.yaml
@@ -0,0 +1,48 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: DomainPermissionsPolicy
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domainpermissionspolicy
+  labels:
+    testing.upbound.io/example-name: test
+  name: test
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    policyDocument: ${data.aws_iam_policy_document.test.json}
+    region: us-west-1
+
+---
+
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domainpermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domain: example
+    encryptionKeySelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    region: us-west-1
+
+---
+
+apiVersion: kms.aws.upbound.io/v1beta1
+kind: Key
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domainpermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    description: domain key
+    region: us-west-1
diff --git a/examples-generated/codeartifact/v1beta1/repository.yaml b/examples-generated/codeartifact/v1beta1/repository.yaml
new file mode 100644
index 0000000000..61518c6b98
--- /dev/null
+++ b/examples-generated/codeartifact/v1beta1/repository.yaml
@@ -0,0 +1,48 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Repository
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: test
+  name: test
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    region: us-west-1
+    repository: example
+
+---
+
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domain: example
+    encryptionKeySelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    region: us-west-1
+
+---
+
+apiVersion: kms.aws.upbound.io/v1beta1
+kind: Key
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    description: domain key
+    region: us-west-1
diff --git a/examples-generated/codeartifact/v1beta1/repositorypermissionspolicy.yaml b/examples-generated/codeartifact/v1beta1/repositorypermissionspolicy.yaml
new file mode 100644
index 0000000000..f9bf886fde
--- /dev/null
+++ b/examples-generated/codeartifact/v1beta1/repositorypermissionspolicy.yaml
@@ -0,0 +1,69 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: RepositoryPermissionsPolicy
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    policyDocument: ${data.aws_iam_policy_document.example.json}
+    region: us-west-1
+    repositorySelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+
+---
+
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domain: example
+    encryptionKeySelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    region: us-west-1
+
+---
+
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Repository
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: example
+    region: us-west-1
+    repository: example
+
+---
+
+apiVersion: kms.aws.upbound.io/v1beta1
+kind: Key
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    description: domain key
+    region: us-west-1
diff --git a/examples/codeartifact/v1beta1/domain.yaml b/examples/codeartifact/v1beta1/domain.yaml
new file mode 100644
index 0000000000..4a5451926f
--- /dev/null
+++ b/examples/codeartifact/v1beta1/domain.yaml
@@ -0,0 +1,12 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domain
+  labels:
+    testing.upbound.io/example-name: example
+  name: example
+spec:
+  forProvider:
+    domain: example
+    region: us-east-2
diff --git a/examples/codeartifact/v1beta1/domainpermissionspolicy.yaml b/examples/codeartifact/v1beta1/domainpermissionspolicy.yaml
new file mode 100644
index 0000000000..a076463877
--- /dev/null
+++ b/examples/codeartifact/v1beta1/domainpermissionspolicy.yaml
@@ -0,0 +1,44 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: DomainPermissionsPolicy
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domainpermissionspolicy
+  labels:
+    testing.upbound.io/example-name: domainpermissionspolicy-example
+  name: domainpermissionspolicy-example
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: domainpermissionspolicy-example
+    policyDocument: |
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Action": [
+                      "codeartifact:CreateRepository"
+                  ],
+                  "Effect": "Allow",
+                  "Principal": {
+                      "AWS": "arn:aws:iam::${data.aws_account_id}:root"
+
+                  },
+                  "Resource": "*"
+              }
+          ]
+      }
+    region: us-east-1
+---
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/domainpermissionspolicy
+  labels:
+    testing.upbound.io/example-name: domainpermissionspolicy-example
+  name: domainpermissionspolicy-example
+spec:
+  forProvider:
+    domain: domainpermissionspolicy-example
+    region: us-east-1
diff --git a/examples/codeartifact/v1beta1/repository.yaml b/examples/codeartifact/v1beta1/repository.yaml
new file mode 100644
index 0000000000..714b768fa7
--- /dev/null
+++ b/examples/codeartifact/v1beta1/repository.yaml
@@ -0,0 +1,48 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Repository
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: test
+  name: test
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: repository-example
+    region: us-east-1
+    repository: example
+
+---
+
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: repository-example
+  name: repository-example
+spec:
+  forProvider:
+    domain: repository-example
+    encryptionKeySelector:
+      matchLabels:
+        testing.upbound.io/example-name: repository-example
+    region: us-east-1
+
+---
+
+apiVersion: kms.aws.upbound.io/v1beta1
+kind: Key
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repository
+  labels:
+    testing.upbound.io/example-name: repository-example
+  name: repository-example
+spec:
+  forProvider:
+    description: Codeartifact domain key
+    region: us-east-1
diff --git a/examples/codeartifact/v1beta1/repositorypermissionspolicy.yaml b/examples/codeartifact/v1beta1/repositorypermissionspolicy.yaml
new file mode 100644
index 0000000000..89d726c87e
--- /dev/null
+++ b/examples/codeartifact/v1beta1/repositorypermissionspolicy.yaml
@@ -0,0 +1,63 @@
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: RepositoryPermissionsPolicy
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: repositorypermissionspolicy-example
+  name: repositorypermissionspolicy-example
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: repositorypermissionspolicy-example
+    policyDocument: |
+      {
+        "Version":"2012-10-17",
+        "Statement":[
+          {
+            "Action":[
+              "codeartifact:ReadFromRepository"
+            ],
+            "Effect":"Allow",
+            "Principal":{
+              "AWS":"arn:aws:iam::${data.aws_account_id}:root"
+            },
+            "Resource":"*"
+          }
+        ]
+      }
+    region: us-east-1
+    repositorySelector:
+      matchLabels:
+        testing.upbound.io/example-name: repositorypermissionspolicy-example
+---
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Domain
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: repositorypermissionspolicy-example
+  name: repositorypermissionspolicy-example
+spec:
+  forProvider:
+    domain: repositorypermissionspolicy-example
+    region: us-east-1
+---
+apiVersion: codeartifact.aws.upbound.io/v1beta1
+kind: Repository
+metadata:
+  annotations:
+    meta.upbound.io/example-id: codeartifact/v1beta1/repositorypermissionspolicy
+  labels:
+    testing.upbound.io/example-name: repositorypermissionspolicy-example
+  name: repositorypermissionspolicy-example
+spec:
+  forProvider:
+    domainSelector:
+      matchLabels:
+        testing.upbound.io/example-name: repositorypermissionspolicy-example
+    region: us-east-1
+    repository: repositorypermissionspolicy-example
+
diff --git a/internal/controller/codeartifact/domain/zz_controller.go b/internal/controller/codeartifact/domain/zz_controller.go
new file mode 100755
index 0000000000..4c8f576b87
--- /dev/null
+++ b/internal/controller/codeartifact/domain/zz_controller.go
@@ -0,0 +1,95 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package domain
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/handler"
+	"github.com/crossplane/upjet/pkg/metrics"
+	"github.com/pkg/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	v1beta1 "github.com/upbound/provider-aws/apis/codeartifact/v1beta1"
+	features "github.com/upbound/provider-aws/internal/features"
+)
+
+// Setup adds a controller that reconciles Domain managed resources.
+func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
+	name := managed.ControllerName(v1beta1.Domain_GroupVersionKind.String())
+	var initializers managed.InitializerChain
+	for _, i := range o.Provider.Resources["aws_codeartifact_domain"].InitializerFns {
+		initializers = append(initializers, i(mgr.GetClient()))
+	}
+	initializers = append(initializers, managed.NewNameAsExternalName(mgr.GetClient()))
+	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
+	if o.SecretStoreConfigGVK != nil {
+		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
+	}
+	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Domain_GroupVersionKind)))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Domain_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
+	opts := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(
+			tjcontroller.NewTerraformPluginSDKAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["aws_codeartifact_domain"],
+				tjcontroller.WithTerraformPluginSDKAsyncLogger(o.Logger),
+				tjcontroller.WithTerraformPluginSDKAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithTerraformPluginSDKAsyncCallbackProvider(ac),
+				tjcontroller.WithTerraformPluginSDKAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Domain_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithTerraformPluginSDKAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+		managed.WithFinalizer(tjcontroller.NewOperationTrackerFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithTimeout(3 * time.Minute),
+		managed.WithInitializers(initializers),
+		managed.WithConnectionPublishers(cps...),
+		managed.WithPollInterval(o.PollInterval),
+	}
+	if o.PollJitter != 0 {
+		opts = append(opts, managed.WithPollJitterHook(o.PollJitter))
+	}
+	if o.Features.Enabled(features.EnableBetaManagementPolicies) {
+		opts = append(opts, managed.WithManagementPolicies())
+	}
+	if o.MetricOptions != nil {
+		opts = append(opts, managed.WithMetricRecorder(o.MetricOptions.MRMetrics))
+	}
+
+	// register webhooks for the kind v1beta1.Domain
+	// if they're enabled.
+	if o.StartWebhooks {
+		if err := ctrl.NewWebhookManagedBy(mgr).
+			For(&v1beta1.Domain{}).
+			Complete(); err != nil {
+			return errors.Wrap(err, "cannot register webhook for the kind v1beta1.Domain")
+		}
+	}
+
+	if o.MetricOptions != nil && o.MetricOptions.MRStateMetrics != nil {
+		stateMetricsRecorder := statemetrics.NewMRStateRecorder(
+			mgr.GetClient(), o.Logger, o.MetricOptions.MRStateMetrics, &v1beta1.DomainList{}, o.MetricOptions.PollStateMetricInterval,
+		)
+		if err := mgr.Add(stateMetricsRecorder); err != nil {
+			return errors.Wrap(err, "cannot register MR state metrics recorder for kind v1beta1.DomainList")
+		}
+	}
+
+	r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1beta1.Domain_GroupVersionKind), opts...)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(xpresource.DesiredStateChanged()).
+		Watches(&v1beta1.Domain{}, eventHandler).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/codeartifact/domainpermissionspolicy/zz_controller.go b/internal/controller/codeartifact/domainpermissionspolicy/zz_controller.go
new file mode 100755
index 0000000000..8f81635c11
--- /dev/null
+++ b/internal/controller/codeartifact/domainpermissionspolicy/zz_controller.go
@@ -0,0 +1,92 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package domainpermissionspolicy
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/handler"
+	"github.com/crossplane/upjet/pkg/metrics"
+	"github.com/pkg/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	v1beta1 "github.com/upbound/provider-aws/apis/codeartifact/v1beta1"
+	features "github.com/upbound/provider-aws/internal/features"
+)
+
+// Setup adds a controller that reconciles DomainPermissionsPolicy managed resources.
+func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
+	name := managed.ControllerName(v1beta1.DomainPermissionsPolicy_GroupVersionKind.String())
+	var initializers managed.InitializerChain
+	initializers = append(initializers, managed.NewNameAsExternalName(mgr.GetClient()))
+	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
+	if o.SecretStoreConfigGVK != nil {
+		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
+	}
+	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DomainPermissionsPolicy_GroupVersionKind)))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DomainPermissionsPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
+	opts := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(
+			tjcontroller.NewTerraformPluginSDKAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["aws_codeartifact_domain_permissions_policy"],
+				tjcontroller.WithTerraformPluginSDKAsyncLogger(o.Logger),
+				tjcontroller.WithTerraformPluginSDKAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithTerraformPluginSDKAsyncCallbackProvider(ac),
+				tjcontroller.WithTerraformPluginSDKAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DomainPermissionsPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithTerraformPluginSDKAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+		managed.WithFinalizer(tjcontroller.NewOperationTrackerFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithTimeout(3 * time.Minute),
+		managed.WithInitializers(initializers),
+		managed.WithConnectionPublishers(cps...),
+		managed.WithPollInterval(o.PollInterval),
+	}
+	if o.PollJitter != 0 {
+		opts = append(opts, managed.WithPollJitterHook(o.PollJitter))
+	}
+	if o.Features.Enabled(features.EnableBetaManagementPolicies) {
+		opts = append(opts, managed.WithManagementPolicies())
+	}
+	if o.MetricOptions != nil {
+		opts = append(opts, managed.WithMetricRecorder(o.MetricOptions.MRMetrics))
+	}
+
+	// register webhooks for the kind v1beta1.DomainPermissionsPolicy
+	// if they're enabled.
+	if o.StartWebhooks {
+		if err := ctrl.NewWebhookManagedBy(mgr).
+			For(&v1beta1.DomainPermissionsPolicy{}).
+			Complete(); err != nil {
+			return errors.Wrap(err, "cannot register webhook for the kind v1beta1.DomainPermissionsPolicy")
+		}
+	}
+
+	if o.MetricOptions != nil && o.MetricOptions.MRStateMetrics != nil {
+		stateMetricsRecorder := statemetrics.NewMRStateRecorder(
+			mgr.GetClient(), o.Logger, o.MetricOptions.MRStateMetrics, &v1beta1.DomainPermissionsPolicyList{}, o.MetricOptions.PollStateMetricInterval,
+		)
+		if err := mgr.Add(stateMetricsRecorder); err != nil {
+			return errors.Wrap(err, "cannot register MR state metrics recorder for kind v1beta1.DomainPermissionsPolicyList")
+		}
+	}
+
+	r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1beta1.DomainPermissionsPolicy_GroupVersionKind), opts...)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(xpresource.DesiredStateChanged()).
+		Watches(&v1beta1.DomainPermissionsPolicy{}, eventHandler).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/codeartifact/repository/zz_controller.go b/internal/controller/codeartifact/repository/zz_controller.go
new file mode 100755
index 0000000000..44e4c995c8
--- /dev/null
+++ b/internal/controller/codeartifact/repository/zz_controller.go
@@ -0,0 +1,95 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package repository
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/handler"
+	"github.com/crossplane/upjet/pkg/metrics"
+	"github.com/pkg/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	v1beta1 "github.com/upbound/provider-aws/apis/codeartifact/v1beta1"
+	features "github.com/upbound/provider-aws/internal/features"
+)
+
+// Setup adds a controller that reconciles Repository managed resources.
+func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
+	name := managed.ControllerName(v1beta1.Repository_GroupVersionKind.String())
+	var initializers managed.InitializerChain
+	for _, i := range o.Provider.Resources["aws_codeartifact_repository"].InitializerFns {
+		initializers = append(initializers, i(mgr.GetClient()))
+	}
+	initializers = append(initializers, managed.NewNameAsExternalName(mgr.GetClient()))
+	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
+	if o.SecretStoreConfigGVK != nil {
+		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
+	}
+	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Repository_GroupVersionKind)))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Repository_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
+	opts := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(
+			tjcontroller.NewTerraformPluginSDKAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["aws_codeartifact_repository"],
+				tjcontroller.WithTerraformPluginSDKAsyncLogger(o.Logger),
+				tjcontroller.WithTerraformPluginSDKAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithTerraformPluginSDKAsyncCallbackProvider(ac),
+				tjcontroller.WithTerraformPluginSDKAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Repository_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithTerraformPluginSDKAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+		managed.WithFinalizer(tjcontroller.NewOperationTrackerFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithTimeout(3 * time.Minute),
+		managed.WithInitializers(initializers),
+		managed.WithConnectionPublishers(cps...),
+		managed.WithPollInterval(o.PollInterval),
+	}
+	if o.PollJitter != 0 {
+		opts = append(opts, managed.WithPollJitterHook(o.PollJitter))
+	}
+	if o.Features.Enabled(features.EnableBetaManagementPolicies) {
+		opts = append(opts, managed.WithManagementPolicies())
+	}
+	if o.MetricOptions != nil {
+		opts = append(opts, managed.WithMetricRecorder(o.MetricOptions.MRMetrics))
+	}
+
+	// register webhooks for the kind v1beta1.Repository
+	// if they're enabled.
+	if o.StartWebhooks {
+		if err := ctrl.NewWebhookManagedBy(mgr).
+			For(&v1beta1.Repository{}).
+			Complete(); err != nil {
+			return errors.Wrap(err, "cannot register webhook for the kind v1beta1.Repository")
+		}
+	}
+
+	if o.MetricOptions != nil && o.MetricOptions.MRStateMetrics != nil {
+		stateMetricsRecorder := statemetrics.NewMRStateRecorder(
+			mgr.GetClient(), o.Logger, o.MetricOptions.MRStateMetrics, &v1beta1.RepositoryList{}, o.MetricOptions.PollStateMetricInterval,
+		)
+		if err := mgr.Add(stateMetricsRecorder); err != nil {
+			return errors.Wrap(err, "cannot register MR state metrics recorder for kind v1beta1.RepositoryList")
+		}
+	}
+
+	r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1beta1.Repository_GroupVersionKind), opts...)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(xpresource.DesiredStateChanged()).
+		Watches(&v1beta1.Repository{}, eventHandler).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/codeartifact/repositorypermissionspolicy/zz_controller.go b/internal/controller/codeartifact/repositorypermissionspolicy/zz_controller.go
new file mode 100755
index 0000000000..7d92cf099d
--- /dev/null
+++ b/internal/controller/codeartifact/repositorypermissionspolicy/zz_controller.go
@@ -0,0 +1,92 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package repositorypermissionspolicy
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/handler"
+	"github.com/crossplane/upjet/pkg/metrics"
+	"github.com/pkg/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	v1beta1 "github.com/upbound/provider-aws/apis/codeartifact/v1beta1"
+	features "github.com/upbound/provider-aws/internal/features"
+)
+
+// Setup adds a controller that reconciles RepositoryPermissionsPolicy managed resources.
+func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
+	name := managed.ControllerName(v1beta1.RepositoryPermissionsPolicy_GroupVersionKind.String())
+	var initializers managed.InitializerChain
+	initializers = append(initializers, managed.NewNameAsExternalName(mgr.GetClient()))
+	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
+	if o.SecretStoreConfigGVK != nil {
+		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
+	}
+	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RepositoryPermissionsPolicy_GroupVersionKind)))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RepositoryPermissionsPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
+	opts := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(
+			tjcontroller.NewTerraformPluginSDKAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["aws_codeartifact_repository_permissions_policy"],
+				tjcontroller.WithTerraformPluginSDKAsyncLogger(o.Logger),
+				tjcontroller.WithTerraformPluginSDKAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithTerraformPluginSDKAsyncCallbackProvider(ac),
+				tjcontroller.WithTerraformPluginSDKAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RepositoryPermissionsPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithTerraformPluginSDKAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+		managed.WithFinalizer(tjcontroller.NewOperationTrackerFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithTimeout(3 * time.Minute),
+		managed.WithInitializers(initializers),
+		managed.WithConnectionPublishers(cps...),
+		managed.WithPollInterval(o.PollInterval),
+	}
+	if o.PollJitter != 0 {
+		opts = append(opts, managed.WithPollJitterHook(o.PollJitter))
+	}
+	if o.Features.Enabled(features.EnableBetaManagementPolicies) {
+		opts = append(opts, managed.WithManagementPolicies())
+	}
+	if o.MetricOptions != nil {
+		opts = append(opts, managed.WithMetricRecorder(o.MetricOptions.MRMetrics))
+	}
+
+	// register webhooks for the kind v1beta1.RepositoryPermissionsPolicy
+	// if they're enabled.
+	if o.StartWebhooks {
+		if err := ctrl.NewWebhookManagedBy(mgr).
+			For(&v1beta1.RepositoryPermissionsPolicy{}).
+			Complete(); err != nil {
+			return errors.Wrap(err, "cannot register webhook for the kind v1beta1.RepositoryPermissionsPolicy")
+		}
+	}
+
+	if o.MetricOptions != nil && o.MetricOptions.MRStateMetrics != nil {
+		stateMetricsRecorder := statemetrics.NewMRStateRecorder(
+			mgr.GetClient(), o.Logger, o.MetricOptions.MRStateMetrics, &v1beta1.RepositoryPermissionsPolicyList{}, o.MetricOptions.PollStateMetricInterval,
+		)
+		if err := mgr.Add(stateMetricsRecorder); err != nil {
+			return errors.Wrap(err, "cannot register MR state metrics recorder for kind v1beta1.RepositoryPermissionsPolicyList")
+		}
+	}
+
+	r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1beta1.RepositoryPermissionsPolicy_GroupVersionKind), opts...)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(xpresource.DesiredStateChanged()).
+		Watches(&v1beta1.RepositoryPermissionsPolicy{}, eventHandler).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/zz_codeartifact_setup.go b/internal/controller/zz_codeartifact_setup.go
new file mode 100755
index 0000000000..1ded61e4de
--- /dev/null
+++ b/internal/controller/zz_codeartifact_setup.go
@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package controller
+
+import (
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	"github.com/crossplane/upjet/pkg/controller"
+
+	domain "github.com/upbound/provider-aws/internal/controller/codeartifact/domain"
+	domainpermissionspolicy "github.com/upbound/provider-aws/internal/controller/codeartifact/domainpermissionspolicy"
+	repository "github.com/upbound/provider-aws/internal/controller/codeartifact/repository"
+	repositorypermissionspolicy "github.com/upbound/provider-aws/internal/controller/codeartifact/repositorypermissionspolicy"
+)
+
+// Setup_codeartifact creates all controllers with the supplied logger and adds them to
+// the supplied manager.
+func Setup_codeartifact(mgr ctrl.Manager, o controller.Options) error {
+	for _, setup := range []func(ctrl.Manager, controller.Options) error{
+		domain.Setup,
+		domainpermissionspolicy.Setup,
+		repository.Setup,
+		repositorypermissionspolicy.Setup,
+	} {
+		if err := setup(mgr, o); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/internal/controller/zz_monolith_setup.go b/internal/controller/zz_monolith_setup.go
index ce1dfa73e5..48e6193fc2 100755
--- a/internal/controller/zz_monolith_setup.go
+++ b/internal/controller/zz_monolith_setup.go
@@ -179,9 +179,13 @@ import (
 	resourcepolicy "github.com/upbound/provider-aws/internal/controller/cloudwatchlogs/resourcepolicy"
 	stream "github.com/upbound/provider-aws/internal/controller/cloudwatchlogs/stream"
 	subscriptionfilter "github.com/upbound/provider-aws/internal/controller/cloudwatchlogs/subscriptionfilter"
+	domaincodeartifact "github.com/upbound/provider-aws/internal/controller/codeartifact/domain"
+	domainpermissionspolicy "github.com/upbound/provider-aws/internal/controller/codeartifact/domainpermissionspolicy"
+	repository "github.com/upbound/provider-aws/internal/controller/codeartifact/repository"
+	repositorypermissionspolicy "github.com/upbound/provider-aws/internal/controller/codeartifact/repositorypermissionspolicy"
 	approvalruletemplate "github.com/upbound/provider-aws/internal/controller/codecommit/approvalruletemplate"
 	approvalruletemplateassociation "github.com/upbound/provider-aws/internal/controller/codecommit/approvalruletemplateassociation"
-	repository "github.com/upbound/provider-aws/internal/controller/codecommit/repository"
+	repositorycodecommit "github.com/upbound/provider-aws/internal/controller/codecommit/repository"
 	trigger "github.com/upbound/provider-aws/internal/controller/codecommit/trigger"
 	profilinggroup "github.com/upbound/provider-aws/internal/controller/codeguruprofiler/profilinggroup"
 	codepipeline "github.com/upbound/provider-aws/internal/controller/codepipeline/codepipeline"
@@ -1125,9 +1129,13 @@ func Setup_monolith(mgr ctrl.Manager, o controller.Options) error {
 		resourcepolicy.Setup,
 		stream.Setup,
 		subscriptionfilter.Setup,
+		domaincodeartifact.Setup,
+		domainpermissionspolicy.Setup,
+		repository.Setup,
+		repositorypermissionspolicy.Setup,
 		approvalruletemplate.Setup,
 		approvalruletemplateassociation.Setup,
-		repository.Setup,
+		repositorycodecommit.Setup,
 		trigger.Setup,
 		profilinggroup.Setup,
 		codepipeline.Setup,
diff --git a/package/crds/codeartifact.aws.upbound.io_domainpermissionspolicies.yaml b/package/crds/codeartifact.aws.upbound.io_domainpermissionspolicies.yaml
new file mode 100644
index 0000000000..9986cc267a
--- /dev/null
+++ b/package/crds/codeartifact.aws.upbound.io_domainpermissionspolicies.yaml
@@ -0,0 +1,470 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: domainpermissionspolicies.codeartifact.aws.upbound.io
+spec:
+  group: codeartifact.aws.upbound.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - aws
+    kind: DomainPermissionsPolicy
+    listKind: DomainPermissionsPolicyList
+    plural: domainpermissionspolicies
+    singular: domainpermissionspolicy
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: DomainPermissionsPolicy is the Schema for the DomainPermissionsPolicys
+          API. Provides a CodeArtifact Domain Permissions Policy resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DomainPermissionsPolicySpec defines the desired state of
+              DomainPermissionsPolicy
+            properties:
+              deletionPolicy:
+                default: Delete
+                description: |-
+                  DeletionPolicy specifies what will happen to the underlying external
+                  when this managed resource is deleted - either "Delete" or "Orphan" the
+                  external resource.
+                  This field is planned to be deprecated in favor of the ManagementPolicies
+                  field in a future release. Currently, both could be set independently and
+                  non-default values would be honored if the feature flag is enabled.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                enum:
+                - Orphan
+                - Delete
+                type: string
+              forProvider:
+                properties:
+                  domain:
+                    description: The name of the domain on which to set the resource
+                      policy.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  domainRef:
+                    description: Reference to a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  domainSelector:
+                    description: Selector for a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                  region:
+                    description: Region is the region you'd like your resource to
+                      be created in.
+                    type: string
+                required:
+                - region
+                type: object
+              initProvider:
+                description: |-
+                  THIS IS A BETA FIELD. It will be honored
+                  unless the Management Policies feature flag is disabled.
+                  InitProvider holds the same fields as ForProvider, with the exception
+                  of Identifier and other resource reference fields. The fields that are
+                  in InitProvider are merged into ForProvider when the resource is created.
+                  The same fields are also added to the terraform ignore_changes hook, to
+                  avoid updating them after creation. This is useful for fields that are
+                  required on creation, but we do not desire to update them after creation,
+                  for example because of an external controller is managing them, like an
+                  autoscaler.
+                properties:
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                type: object
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  This field is planned to replace the DeletionPolicy field in a future
+                  release. Currently, both could be set independently and non-default
+                  values would be honored if the feature flag is enabled. If both are
+                  custom, the DeletionPolicy field will be ignored.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                  policy:
+                    description: Policies for referencing.
+                    properties:
+                      resolution:
+                        default: Required
+                        description: |-
+                          Resolution specifies whether resolution of this reference is required.
+                          The default is 'Required', which means the reconcile will fail if the
+                          reference cannot be resolved. 'Optional' means this reference will be
+                          a no-op if it cannot be resolved.
+                        enum:
+                        - Required
+                        - Optional
+                        type: string
+                      resolve:
+                        description: |-
+                          Resolve specifies when this reference should be resolved. The default
+                          is 'IfNotPresent', which will attempt to resolve the reference only when
+                          the corresponding field is not present. Use 'Always' to resolve the
+                          reference on every reconcile.
+                        enum:
+                        - Always
+                        - IfNotPresent
+                        type: string
+                    type: object
+                required:
+                - name
+                type: object
+              publishConnectionDetailsTo:
+                description: |-
+                  PublishConnectionDetailsTo specifies the connection secret config which
+                  contains a name, metadata and a reference to secret store config to
+                  which any connection details for this managed resource should be written.
+                  Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  configRef:
+                    default:
+                      name: default
+                    description: |-
+                      SecretStoreConfigRef specifies which secret store config should be used
+                      for this ConnectionSecret.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  metadata:
+                    description: Metadata is the metadata for connection secret.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Annotations are the annotations to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.annotations".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Labels are the labels/tags to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.labels".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      type:
+                        description: |-
+                          Type is the SecretType for the connection secret.
+                          - Only valid for Kubernetes Secret Stores.
+                        type: string
+                    type: object
+                  name:
+                    description: Name is the name of the connection secret.
+                    type: string
+                required:
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                  This field is planned to be replaced in a future release in favor of
+                  PublishConnectionDetailsTo. Currently, both could be set independently
+                  and connection details would be published to both without affecting
+                  each other.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                  namespace:
+                    description: Namespace of the secret.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - forProvider
+            type: object
+            x-kubernetes-validations:
+            - message: spec.forProvider.policyDocument is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.policyDocument)
+                || (has(self.initProvider) && has(self.initProvider.policyDocument))'
+          status:
+            description: DomainPermissionsPolicyStatus defines the observed state
+              of DomainPermissionsPolicy.
+            properties:
+              atProvider:
+                properties:
+                  domain:
+                    description: The name of the domain on which to set the resource
+                      policy.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  id:
+                    description: The Name of Domain.
+                    type: string
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                  resourceArn:
+                    description: The ARN of the resource associated with the resource
+                      policy.
+                    type: string
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/codeartifact.aws.upbound.io_domains.yaml b/package/crds/codeartifact.aws.upbound.io_domains.yaml
new file mode 100644
index 0000000000..c25b3c3fb9
--- /dev/null
+++ b/package/crds/codeartifact.aws.upbound.io_domains.yaml
@@ -0,0 +1,571 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: domains.codeartifact.aws.upbound.io
+spec:
+  group: codeartifact.aws.upbound.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - aws
+    kind: Domain
+    listKind: DomainList
+    plural: domains
+    singular: domain
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Domain is the Schema for the Domains API. Provides a CodeArtifact
+          Domain resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DomainSpec defines the desired state of Domain
+            properties:
+              deletionPolicy:
+                default: Delete
+                description: |-
+                  DeletionPolicy specifies what will happen to the underlying external
+                  when this managed resource is deleted - either "Delete" or "Orphan" the
+                  external resource.
+                  This field is planned to be deprecated in favor of the ManagementPolicies
+                  field in a future release. Currently, both could be set independently and
+                  non-default values would be honored if the feature flag is enabled.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                enum:
+                - Orphan
+                - Delete
+                type: string
+              forProvider:
+                properties:
+                  domain:
+                    description: The name of the domain to create. All domain names
+                      in an AWS Region that are in the same AWS account must be unique.
+                      The domain name is used as the prefix in DNS hostnames. Do not
+                      use sensitive information in a domain name because it is publicly
+                      discoverable.
+                    type: string
+                  encryptionKey:
+                    description: The encryption key for the domain. This is used to
+                      encrypt content stored in a domain. The KMS Key Amazon Resource
+                      Name (ARN). The default aws/codeartifact AWS KMS master key
+                      is used if this element is absent.
+                    type: string
+                  encryptionKeyRef:
+                    description: Reference to a Key in kms to populate encryptionKey.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  encryptionKeySelector:
+                    description: Selector for a Key in kms to populate encryptionKey.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                  region:
+                    description: Region is the region you'd like your resource to
+                      be created in.
+                    type: string
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                required:
+                - region
+                type: object
+              initProvider:
+                description: |-
+                  THIS IS A BETA FIELD. It will be honored
+                  unless the Management Policies feature flag is disabled.
+                  InitProvider holds the same fields as ForProvider, with the exception
+                  of Identifier and other resource reference fields. The fields that are
+                  in InitProvider are merged into ForProvider when the resource is created.
+                  The same fields are also added to the terraform ignore_changes hook, to
+                  avoid updating them after creation. This is useful for fields that are
+                  required on creation, but we do not desire to update them after creation,
+                  for example because of an external controller is managing them, like an
+                  autoscaler.
+                properties:
+                  domain:
+                    description: The name of the domain to create. All domain names
+                      in an AWS Region that are in the same AWS account must be unique.
+                      The domain name is used as the prefix in DNS hostnames. Do not
+                      use sensitive information in a domain name because it is publicly
+                      discoverable.
+                    type: string
+                  encryptionKey:
+                    description: The encryption key for the domain. This is used to
+                      encrypt content stored in a domain. The KMS Key Amazon Resource
+                      Name (ARN). The default aws/codeartifact AWS KMS master key
+                      is used if this element is absent.
+                    type: string
+                  encryptionKeyRef:
+                    description: Reference to a Key in kms to populate encryptionKey.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  encryptionKeySelector:
+                    description: Selector for a Key in kms to populate encryptionKey.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                type: object
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  This field is planned to replace the DeletionPolicy field in a future
+                  release. Currently, both could be set independently and non-default
+                  values would be honored if the feature flag is enabled. If both are
+                  custom, the DeletionPolicy field will be ignored.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                  policy:
+                    description: Policies for referencing.
+                    properties:
+                      resolution:
+                        default: Required
+                        description: |-
+                          Resolution specifies whether resolution of this reference is required.
+                          The default is 'Required', which means the reconcile will fail if the
+                          reference cannot be resolved. 'Optional' means this reference will be
+                          a no-op if it cannot be resolved.
+                        enum:
+                        - Required
+                        - Optional
+                        type: string
+                      resolve:
+                        description: |-
+                          Resolve specifies when this reference should be resolved. The default
+                          is 'IfNotPresent', which will attempt to resolve the reference only when
+                          the corresponding field is not present. Use 'Always' to resolve the
+                          reference on every reconcile.
+                        enum:
+                        - Always
+                        - IfNotPresent
+                        type: string
+                    type: object
+                required:
+                - name
+                type: object
+              publishConnectionDetailsTo:
+                description: |-
+                  PublishConnectionDetailsTo specifies the connection secret config which
+                  contains a name, metadata and a reference to secret store config to
+                  which any connection details for this managed resource should be written.
+                  Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  configRef:
+                    default:
+                      name: default
+                    description: |-
+                      SecretStoreConfigRef specifies which secret store config should be used
+                      for this ConnectionSecret.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  metadata:
+                    description: Metadata is the metadata for connection secret.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Annotations are the annotations to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.annotations".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Labels are the labels/tags to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.labels".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      type:
+                        description: |-
+                          Type is the SecretType for the connection secret.
+                          - Only valid for Kubernetes Secret Stores.
+                        type: string
+                    type: object
+                  name:
+                    description: Name is the name of the connection secret.
+                    type: string
+                required:
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                  This field is planned to be replaced in a future release in favor of
+                  PublishConnectionDetailsTo. Currently, both could be set independently
+                  and connection details would be published to both without affecting
+                  each other.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                  namespace:
+                    description: Namespace of the secret.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - forProvider
+            type: object
+            x-kubernetes-validations:
+            - message: spec.forProvider.domain is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.domain)
+                || (has(self.initProvider) && has(self.initProvider.domain))'
+          status:
+            description: DomainStatus defines the observed state of Domain.
+            properties:
+              atProvider:
+                properties:
+                  arn:
+                    description: The ARN of the Domain.
+                    type: string
+                  assetSizeBytes:
+                    description: The total size of all assets in the domain.
+                    type: string
+                  createdTime:
+                    description: A timestamp that represents the date and time the
+                      domain was created in RFC3339 format.
+                    type: string
+                  domain:
+                    description: The name of the domain to create. All domain names
+                      in an AWS Region that are in the same AWS account must be unique.
+                      The domain name is used as the prefix in DNS hostnames. Do not
+                      use sensitive information in a domain name because it is publicly
+                      discoverable.
+                    type: string
+                  encryptionKey:
+                    description: The encryption key for the domain. This is used to
+                      encrypt content stored in a domain. The KMS Key Amazon Resource
+                      Name (ARN). The default aws/codeartifact AWS KMS master key
+                      is used if this element is absent.
+                    type: string
+                  id:
+                    description: The ARN of the Domain.
+                    type: string
+                  owner:
+                    description: The AWS account ID that owns the domain.
+                    type: string
+                  repositoryCount:
+                    description: The number of repositories in the domain.
+                    type: number
+                  s3BucketArn:
+                    description: The ARN of the Amazon S3 bucket that is used to store
+                      package assets in the domain.
+                    type: string
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                  tagsAll:
+                    additionalProperties:
+                      type: string
+                    description: A map of tags assigned to the resource, including
+                      those inherited from the provider default_tags configuration
+                      block.
+                    type: object
+                    x-kubernetes-map-type: granular
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/codeartifact.aws.upbound.io_repositories.yaml b/package/crds/codeartifact.aws.upbound.io_repositories.yaml
new file mode 100644
index 0000000000..faa9554615
--- /dev/null
+++ b/package/crds/codeartifact.aws.upbound.io_repositories.yaml
@@ -0,0 +1,705 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: repositories.codeartifact.aws.upbound.io
+spec:
+  group: codeartifact.aws.upbound.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - aws
+    kind: Repository
+    listKind: RepositoryList
+    plural: repositories
+    singular: repository
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Repository is the Schema for the Repositorys API. Provides a
+          CodeArtifact Repository resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RepositorySpec defines the desired state of Repository
+            properties:
+              deletionPolicy:
+                default: Delete
+                description: |-
+                  DeletionPolicy specifies what will happen to the underlying external
+                  when this managed resource is deleted - either "Delete" or "Orphan" the
+                  external resource.
+                  This field is planned to be deprecated in favor of the ManagementPolicies
+                  field in a future release. Currently, both could be set independently and
+                  non-default values would be honored if the feature flag is enabled.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                enum:
+                - Orphan
+                - Delete
+                type: string
+              forProvider:
+                properties:
+                  description:
+                    description: The description of the repository.
+                    type: string
+                  domain:
+                    description: The domain that contains the created repository.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  domainRef:
+                    description: Reference to a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  domainSelector:
+                    description: Selector for a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                  externalConnections:
+                    description: An array of external connections associated with
+                      the repository. Only one external connection can be set per
+                      repository. see External Connections.
+                    properties:
+                      externalConnectionName:
+                        description: The name of the external connection associated
+                          with a repository.
+                        type: string
+                    type: object
+                  region:
+                    description: Region is the region you'd like your resource to
+                      be created in.
+                    type: string
+                  repository:
+                    description: The name of the repository to create.
+                    type: string
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                  upstream:
+                    description: A list of upstream repositories to associate with
+                      the repository. The order of the upstream repositories in the
+                      list determines their priority order when AWS CodeArtifact looks
+                      for a requested package version. see Upstream
+                    items:
+                      properties:
+                        repositoryName:
+                          description: The name of an upstream repository.
+                          type: string
+                        repositoryNameRef:
+                          description: Reference to a Repository in codeartifact to
+                            populate repositoryName.
+                          properties:
+                            name:
+                              description: Name of the referenced object.
+                              type: string
+                            policy:
+                              description: Policies for referencing.
+                              properties:
+                                resolution:
+                                  default: Required
+                                  description: |-
+                                    Resolution specifies whether resolution of this reference is required.
+                                    The default is 'Required', which means the reconcile will fail if the
+                                    reference cannot be resolved. 'Optional' means this reference will be
+                                    a no-op if it cannot be resolved.
+                                  enum:
+                                  - Required
+                                  - Optional
+                                  type: string
+                                resolve:
+                                  description: |-
+                                    Resolve specifies when this reference should be resolved. The default
+                                    is 'IfNotPresent', which will attempt to resolve the reference only when
+                                    the corresponding field is not present. Use 'Always' to resolve the
+                                    reference on every reconcile.
+                                  enum:
+                                  - Always
+                                  - IfNotPresent
+                                  type: string
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        repositoryNameSelector:
+                          description: Selector for a Repository in codeartifact to
+                            populate repositoryName.
+                          properties:
+                            matchControllerRef:
+                              description: |-
+                                MatchControllerRef ensures an object with the same controller reference
+                                as the selecting object is selected.
+                              type: boolean
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: MatchLabels ensures an object with matching
+                                labels is selected.
+                              type: object
+                            policy:
+                              description: Policies for selection.
+                              properties:
+                                resolution:
+                                  default: Required
+                                  description: |-
+                                    Resolution specifies whether resolution of this reference is required.
+                                    The default is 'Required', which means the reconcile will fail if the
+                                    reference cannot be resolved. 'Optional' means this reference will be
+                                    a no-op if it cannot be resolved.
+                                  enum:
+                                  - Required
+                                  - Optional
+                                  type: string
+                                resolve:
+                                  description: |-
+                                    Resolve specifies when this reference should be resolved. The default
+                                    is 'IfNotPresent', which will attempt to resolve the reference only when
+                                    the corresponding field is not present. Use 'Always' to resolve the
+                                    reference on every reconcile.
+                                  enum:
+                                  - Always
+                                  - IfNotPresent
+                                  type: string
+                              type: object
+                          type: object
+                      type: object
+                    type: array
+                required:
+                - region
+                type: object
+              initProvider:
+                description: |-
+                  THIS IS A BETA FIELD. It will be honored
+                  unless the Management Policies feature flag is disabled.
+                  InitProvider holds the same fields as ForProvider, with the exception
+                  of Identifier and other resource reference fields. The fields that are
+                  in InitProvider are merged into ForProvider when the resource is created.
+                  The same fields are also added to the terraform ignore_changes hook, to
+                  avoid updating them after creation. This is useful for fields that are
+                  required on creation, but we do not desire to update them after creation,
+                  for example because of an external controller is managing them, like an
+                  autoscaler.
+                properties:
+                  description:
+                    description: The description of the repository.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  externalConnections:
+                    description: An array of external connections associated with
+                      the repository. Only one external connection can be set per
+                      repository. see External Connections.
+                    properties:
+                      externalConnectionName:
+                        description: The name of the external connection associated
+                          with a repository.
+                        type: string
+                    type: object
+                  repository:
+                    description: The name of the repository to create.
+                    type: string
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                  upstream:
+                    description: A list of upstream repositories to associate with
+                      the repository. The order of the upstream repositories in the
+                      list determines their priority order when AWS CodeArtifact looks
+                      for a requested package version. see Upstream
+                    items:
+                      properties:
+                        repositoryName:
+                          description: The name of an upstream repository.
+                          type: string
+                        repositoryNameRef:
+                          description: Reference to a Repository in codeartifact to
+                            populate repositoryName.
+                          properties:
+                            name:
+                              description: Name of the referenced object.
+                              type: string
+                            policy:
+                              description: Policies for referencing.
+                              properties:
+                                resolution:
+                                  default: Required
+                                  description: |-
+                                    Resolution specifies whether resolution of this reference is required.
+                                    The default is 'Required', which means the reconcile will fail if the
+                                    reference cannot be resolved. 'Optional' means this reference will be
+                                    a no-op if it cannot be resolved.
+                                  enum:
+                                  - Required
+                                  - Optional
+                                  type: string
+                                resolve:
+                                  description: |-
+                                    Resolve specifies when this reference should be resolved. The default
+                                    is 'IfNotPresent', which will attempt to resolve the reference only when
+                                    the corresponding field is not present. Use 'Always' to resolve the
+                                    reference on every reconcile.
+                                  enum:
+                                  - Always
+                                  - IfNotPresent
+                                  type: string
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        repositoryNameSelector:
+                          description: Selector for a Repository in codeartifact to
+                            populate repositoryName.
+                          properties:
+                            matchControllerRef:
+                              description: |-
+                                MatchControllerRef ensures an object with the same controller reference
+                                as the selecting object is selected.
+                              type: boolean
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: MatchLabels ensures an object with matching
+                                labels is selected.
+                              type: object
+                            policy:
+                              description: Policies for selection.
+                              properties:
+                                resolution:
+                                  default: Required
+                                  description: |-
+                                    Resolution specifies whether resolution of this reference is required.
+                                    The default is 'Required', which means the reconcile will fail if the
+                                    reference cannot be resolved. 'Optional' means this reference will be
+                                    a no-op if it cannot be resolved.
+                                  enum:
+                                  - Required
+                                  - Optional
+                                  type: string
+                                resolve:
+                                  description: |-
+                                    Resolve specifies when this reference should be resolved. The default
+                                    is 'IfNotPresent', which will attempt to resolve the reference only when
+                                    the corresponding field is not present. Use 'Always' to resolve the
+                                    reference on every reconcile.
+                                  enum:
+                                  - Always
+                                  - IfNotPresent
+                                  type: string
+                              type: object
+                          type: object
+                      type: object
+                    type: array
+                type: object
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  This field is planned to replace the DeletionPolicy field in a future
+                  release. Currently, both could be set independently and non-default
+                  values would be honored if the feature flag is enabled. If both are
+                  custom, the DeletionPolicy field will be ignored.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                  policy:
+                    description: Policies for referencing.
+                    properties:
+                      resolution:
+                        default: Required
+                        description: |-
+                          Resolution specifies whether resolution of this reference is required.
+                          The default is 'Required', which means the reconcile will fail if the
+                          reference cannot be resolved. 'Optional' means this reference will be
+                          a no-op if it cannot be resolved.
+                        enum:
+                        - Required
+                        - Optional
+                        type: string
+                      resolve:
+                        description: |-
+                          Resolve specifies when this reference should be resolved. The default
+                          is 'IfNotPresent', which will attempt to resolve the reference only when
+                          the corresponding field is not present. Use 'Always' to resolve the
+                          reference on every reconcile.
+                        enum:
+                        - Always
+                        - IfNotPresent
+                        type: string
+                    type: object
+                required:
+                - name
+                type: object
+              publishConnectionDetailsTo:
+                description: |-
+                  PublishConnectionDetailsTo specifies the connection secret config which
+                  contains a name, metadata and a reference to secret store config to
+                  which any connection details for this managed resource should be written.
+                  Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  configRef:
+                    default:
+                      name: default
+                    description: |-
+                      SecretStoreConfigRef specifies which secret store config should be used
+                      for this ConnectionSecret.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  metadata:
+                    description: Metadata is the metadata for connection secret.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Annotations are the annotations to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.annotations".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Labels are the labels/tags to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.labels".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      type:
+                        description: |-
+                          Type is the SecretType for the connection secret.
+                          - Only valid for Kubernetes Secret Stores.
+                        type: string
+                    type: object
+                  name:
+                    description: Name is the name of the connection secret.
+                    type: string
+                required:
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                  This field is planned to be replaced in a future release in favor of
+                  PublishConnectionDetailsTo. Currently, both could be set independently
+                  and connection details would be published to both without affecting
+                  each other.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                  namespace:
+                    description: Namespace of the secret.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - forProvider
+            type: object
+            x-kubernetes-validations:
+            - message: spec.forProvider.repository is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.repository)
+                || (has(self.initProvider) && has(self.initProvider.repository))'
+          status:
+            description: RepositoryStatus defines the observed state of Repository.
+            properties:
+              atProvider:
+                properties:
+                  administratorAccount:
+                    description: The account number of the AWS account that manages
+                      the repository.
+                    type: string
+                  arn:
+                    description: The ARN of the repository.
+                    type: string
+                  description:
+                    description: The description of the repository.
+                    type: string
+                  domain:
+                    description: The domain that contains the created repository.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  externalConnections:
+                    description: An array of external connections associated with
+                      the repository. Only one external connection can be set per
+                      repository. see External Connections.
+                    properties:
+                      externalConnectionName:
+                        description: The name of the external connection associated
+                          with a repository.
+                        type: string
+                      packageFormat:
+                        type: string
+                      status:
+                        type: string
+                    type: object
+                  id:
+                    description: The ARN of the repository.
+                    type: string
+                  repository:
+                    description: The name of the repository to create.
+                    type: string
+                  tags:
+                    additionalProperties:
+                      type: string
+                    description: Key-value map of resource tags.
+                    type: object
+                    x-kubernetes-map-type: granular
+                  tagsAll:
+                    additionalProperties:
+                      type: string
+                    description: A map of tags assigned to the resource, including
+                      those inherited from the provider default_tags configuration
+                      block.
+                    type: object
+                    x-kubernetes-map-type: granular
+                  upstream:
+                    description: A list of upstream repositories to associate with
+                      the repository. The order of the upstream repositories in the
+                      list determines their priority order when AWS CodeArtifact looks
+                      for a requested package version. see Upstream
+                    items:
+                      properties:
+                        repositoryName:
+                          description: The name of an upstream repository.
+                          type: string
+                      type: object
+                    type: array
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/package/crds/codeartifact.aws.upbound.io_repositorypermissionspolicies.yaml b/package/crds/codeartifact.aws.upbound.io_repositorypermissionspolicies.yaml
new file mode 100644
index 0000000000..375ca08d9e
--- /dev/null
+++ b/package/crds/codeartifact.aws.upbound.io_repositorypermissionspolicies.yaml
@@ -0,0 +1,555 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: repositorypermissionspolicies.codeartifact.aws.upbound.io
+spec:
+  group: codeartifact.aws.upbound.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - aws
+    kind: RepositoryPermissionsPolicy
+    listKind: RepositoryPermissionsPolicyList
+    plural: repositorypermissionspolicies
+    singular: repositorypermissionspolicy
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: RepositoryPermissionsPolicy is the Schema for the RepositoryPermissionsPolicys
+          API. Provides a CodeArtifact Repository Permissions Policy resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: RepositoryPermissionsPolicySpec defines the desired state
+              of RepositoryPermissionsPolicy
+            properties:
+              deletionPolicy:
+                default: Delete
+                description: |-
+                  DeletionPolicy specifies what will happen to the underlying external
+                  when this managed resource is deleted - either "Delete" or "Orphan" the
+                  external resource.
+                  This field is planned to be deprecated in favor of the ManagementPolicies
+                  field in a future release. Currently, both could be set independently and
+                  non-default values would be honored if the feature flag is enabled.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                enum:
+                - Orphan
+                - Delete
+                type: string
+              forProvider:
+                properties:
+                  domain:
+                    description: The name of the domain on which to set the resource
+                      policy.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  domainRef:
+                    description: Reference to a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  domainSelector:
+                    description: Selector for a Domain in codeartifact to populate
+                      domain.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                  region:
+                    description: Region is the region you'd like your resource to
+                      be created in.
+                    type: string
+                  repository:
+                    description: The name of the repository to set the resource policy
+                      on.
+                    type: string
+                  repositoryRef:
+                    description: Reference to a Repository in codeartifact to populate
+                      repository.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  repositorySelector:
+                    description: Selector for a Repository in codeartifact to populate
+                      repository.
+                    properties:
+                      matchControllerRef:
+                        description: |-
+                          MatchControllerRef ensures an object with the same controller reference
+                          as the selecting object is selected.
+                        type: boolean
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: MatchLabels ensures an object with matching labels
+                          is selected.
+                        type: object
+                      policy:
+                        description: Policies for selection.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    type: object
+                required:
+                - region
+                type: object
+              initProvider:
+                description: |-
+                  THIS IS A BETA FIELD. It will be honored
+                  unless the Management Policies feature flag is disabled.
+                  InitProvider holds the same fields as ForProvider, with the exception
+                  of Identifier and other resource reference fields. The fields that are
+                  in InitProvider are merged into ForProvider when the resource is created.
+                  The same fields are also added to the terraform ignore_changes hook, to
+                  avoid updating them after creation. This is useful for fields that are
+                  required on creation, but we do not desire to update them after creation,
+                  for example because of an external controller is managing them, like an
+                  autoscaler.
+                properties:
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                type: object
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  This field is planned to replace the DeletionPolicy field in a future
+                  release. Currently, both could be set independently and non-default
+                  values would be honored if the feature flag is enabled. If both are
+                  custom, the DeletionPolicy field will be ignored.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                  policy:
+                    description: Policies for referencing.
+                    properties:
+                      resolution:
+                        default: Required
+                        description: |-
+                          Resolution specifies whether resolution of this reference is required.
+                          The default is 'Required', which means the reconcile will fail if the
+                          reference cannot be resolved. 'Optional' means this reference will be
+                          a no-op if it cannot be resolved.
+                        enum:
+                        - Required
+                        - Optional
+                        type: string
+                      resolve:
+                        description: |-
+                          Resolve specifies when this reference should be resolved. The default
+                          is 'IfNotPresent', which will attempt to resolve the reference only when
+                          the corresponding field is not present. Use 'Always' to resolve the
+                          reference on every reconcile.
+                        enum:
+                        - Always
+                        - IfNotPresent
+                        type: string
+                    type: object
+                required:
+                - name
+                type: object
+              publishConnectionDetailsTo:
+                description: |-
+                  PublishConnectionDetailsTo specifies the connection secret config which
+                  contains a name, metadata and a reference to secret store config to
+                  which any connection details for this managed resource should be written.
+                  Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  configRef:
+                    default:
+                      name: default
+                    description: |-
+                      SecretStoreConfigRef specifies which secret store config should be used
+                      for this ConnectionSecret.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  metadata:
+                    description: Metadata is the metadata for connection secret.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Annotations are the annotations to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.annotations".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Labels are the labels/tags to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.labels".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      type:
+                        description: |-
+                          Type is the SecretType for the connection secret.
+                          - Only valid for Kubernetes Secret Stores.
+                        type: string
+                    type: object
+                  name:
+                    description: Name is the name of the connection secret.
+                    type: string
+                required:
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                  This field is planned to be replaced in a future release in favor of
+                  PublishConnectionDetailsTo. Currently, both could be set independently
+                  and connection details would be published to both without affecting
+                  each other.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                  namespace:
+                    description: Namespace of the secret.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - forProvider
+            type: object
+            x-kubernetes-validations:
+            - message: spec.forProvider.policyDocument is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.policyDocument)
+                || (has(self.initProvider) && has(self.initProvider.policyDocument))'
+          status:
+            description: RepositoryPermissionsPolicyStatus defines the observed state
+              of RepositoryPermissionsPolicy.
+            properties:
+              atProvider:
+                properties:
+                  domain:
+                    description: The name of the domain on which to set the resource
+                      policy.
+                    type: string
+                  domainOwner:
+                    description: The account number of the AWS account that owns the
+                      domain.
+                    type: string
+                  id:
+                    description: The ARN of the resource associated with the resource
+                      policy.
+                    type: string
+                  policyDocument:
+                    description: A JSON policy string to be set as the access control
+                      resource policy on the provided domain.
+                    type: string
+                  policyRevision:
+                    description: The current revision of the resource policy to be
+                      set. This revision is used for optimistic locking, which prevents
+                      others from overwriting your changes to the domain's resource
+                      policy.
+                    type: string
+                  repository:
+                    description: The name of the repository to set the resource policy
+                      on.
+                    type: string
+                  resourceArn:
+                    description: The ARN of the resource associated with the resource
+                      policy.
+                    type: string
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}