A build pipeline publishes artifacts to an AWS CodeArtifact repository. The developer needs to cache dependencies from Maven Central (a public registry) with minimal changes to the existing pipeline. Which approach satisfies this requirement?

The correct approach is to update the existing CodeArtifact repository with an upstream association to Maven Central. CodeArtifact repositories can be configured to fetch packages from upstream repositories, including public registries like Maven Central, when a requested package is not found locally. This allows the existing pipeline to continue publishing to the same repository while transparently resolving dependencies from Maven Central, minimizing changes. Creating a new CodeArtifact repository or domain would require reconfiguring the build pipeline to publish to the new location, which is not a minimal change. External connections are used for connecting to public registries directly, but an upstream association is the standard and most integrated way to cache public dependencies within an existing repository. Changing the resource policy does not enable fetching from public registries; it controls access permissions to the repository itself.