A developer must cache dependent artifacts from Maven Central, a public package repository, as part of an application's build pipeline. The build pipeline has an AWS CodeArtifact repository where arti

By associating an upstream repository (configured with an external connection to Maven Central) with the existing CodeArtifact repository, package requests that miss the local cache are automatically fetched from Maven Central and stored. This approach requires only a repository configuration change and no modifications to the build pipeline's repository URL, satisfying the minimum-changes requirement.

Creating a new repository requires updating the build pipeline to point to the new repository URL, which constitutes additional pipeline changes beyond the minimum required.

Creating a new CodeArtifact domain and repository is unnecessary overhead; the existing repository can be enhanced with an upstream association, and a new domain adds administrative complexity.

CodeArtifact resource policies control cross-account access permissions, not the ability to fetch packages from public external repositories; external connections are configured through upstream repository associations, not resource policies.