diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index fda50c68fc64..e8548f92086f 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -644,6 +644,7 @@ into Terraform.
   - In `website/allowed-subcategories.txt`: Add a name acceptable for the documentation navigation.
   - In `website/docs/guides/custom-service-endpoints.html.md`: Add the service
     name in the list of customizable endpoints.
+  - In `infrastructure/repository/labels-service.tf`: Add the new service to create a repository label.
   - In `.hashibot.hcl`: Add the new service to automated issue and pull request labeling. e.g. with the `quicksight` service
 
   ```hcl
diff --git a/.hashibot.hcl b/.hashibot.hcl
index f8334a4bb715..86dbb9baf674 100644
--- a/.hashibot.hcl
+++ b/.hashibot.hcl
@@ -542,6 +542,7 @@ behavior "pull_request_path_labeler" "service_labels" {
       "aws/provider.go",
       "aws/utils.go",
       "GNUmakefile",
+      "infrastructure/**/*",
       "main.go",
       "renovate.json",
       "website/docs/index.html.markdown",
diff --git a/infrastructure/README.md b/infrastructure/README.md
new file mode 100644
index 000000000000..c09f277cde62
--- /dev/null
+++ b/infrastructure/README.md
@@ -0,0 +1,5 @@
+# infrastructure
+
+Terraform configurations for managing Terraform AWS Provider infrastructure components.
+
+- [repository](./repository): Manages the code repository, e.g. labels.
diff --git a/infrastructure/repository/README.md b/infrastructure/repository/README.md
new file mode 100644
index 000000000000..7f55d03943f6
--- /dev/null
+++ b/infrastructure/repository/README.md
@@ -0,0 +1,5 @@
+# repository
+
+Public Terraform configuration for managing the `terraform-provider-aws` code repository, to enable community contributions. Currently only utilized for managing AWS Partition, AWS Service, and workflow labels.
+
+HashiCorp maintainers should utilize the `terraform-repositories` repository for managing more sensitive configuration.
diff --git a/infrastructure/repository/labels-partition.tf b/infrastructure/repository/labels-partition.tf
new file mode 100644
index 000000000000..30fa3d006b32
--- /dev/null
+++ b/infrastructure/repository/labels-partition.tf
@@ -0,0 +1,18 @@
+variable "partition_labels" {
+  default = [
+    "aws-cn",
+    "aws-iso",
+    "aws-iso-b",
+    "aws-us-gov",
+  ]
+  description = "Set of AWS Partition labels"
+  type        = set(string)
+}
+
+resource "github_issue_label" "partition" {
+  for_each = var.partition_labels
+
+  repository = "terraform-provider-aws"
+  name       = "partition/${each.value}"
+  color      = "bfd4f2"
+}
diff --git a/infrastructure/repository/labels-service.tf b/infrastructure/repository/labels-service.tf
new file mode 100644
index 000000000000..079baf5d5cb1
--- /dev/null
+++ b/infrastructure/repository/labels-service.tf
@@ -0,0 +1,194 @@
+#
+# For future consideration, this list could be automatically generated
+# via the AWS SDK service list.
+#
+
+variable "service_labels" {
+  default = [
+    "accessanalyzer",
+    "acm",
+    "acmpca",
+    "alexaforbusiness",
+    "amplify",
+    "apigateway",
+    "apigatewaymanagementapi",
+    "apigatewayv2",
+    "appconfig",
+    "applicationautoscaling",
+    "applicationdiscoveryservice",
+    "applicationinsights",
+    "appmesh",
+    "appstream",
+    "appsync",
+    "athena",
+    "autoscaling",
+    "autoscalingplans",
+    "backup",
+    "batch",
+    "budgets",
+    "chime",
+    "cloud9",
+    "clouddirectory",
+    "cloudformation",
+    "cloudfront",
+    "cloudhsm",
+    "cloudhsmv2",
+    "cloudsearch",
+    "cloudtrail",
+    "cloudwatch",
+    "cloudwatchevents",
+    "cloudwatchlogs",
+    "codebuild",
+    "codecommit",
+    "codedeploy",
+    "codeguruprofiler",
+    "codegurureviewer",
+    "codepipeline",
+    "codestar",
+    "codestarnotifications",
+    "cognito",
+    "comprehend",
+    "comprehendmedical",
+    "computeoptimizer",
+    "configservice",
+    "connect",
+    "costandusagereportservice",
+    "databasemigrationservice",
+    "dataexchange",
+    "datapipeline",
+    "datasync",
+    "dax",
+    "devicefarm",
+    "directconnect",
+    "directoryservice",
+    "dlm",
+    "docdb",
+    "dynamodb",
+    "ec2-classic",
+    "ec2",
+    "ecr",
+    "ecs",
+    "efs",
+    "eks",
+    "elastic-transcoder",
+    "elasticache",
+    "elasticbeanstalk",
+    "elasticinference",
+    "elasticsearch",
+    "elb",
+    "elbv2",
+    "emr",
+    "eventbridge",
+    "firehose",
+    "fms",
+    "forecastservice",
+    "frauddetector",
+    "fsx",
+    "gamelift",
+    "glacier",
+    "globalaccelerator",
+    "glue",
+    "greengrass",
+    "groundstation",
+    "guardduty",
+    "iam",
+    "imagebuilder",
+    "inspector",
+    "iot",
+    "iotanalytics",
+    "iotevents",
+    "iotsecuretunneling",
+    "iotthingsgraph",
+    "kafka",
+    "kendra",
+    "kinesis",
+    "kinesisanalytics",
+    "kinesisanalyticsv2",
+    "kinesisvideo",
+    "kms",
+    "lakeformation",
+    "lambda",
+    "lexmodelbuildingservice",
+    "licensemanager",
+    "lightsail",
+    "machinelearning",
+    "macie",
+    "managedblockchain",
+    "marketplacecatalog",
+    "mediaconnect",
+    "mediaconvert",
+    "medialive",
+    "mediapackage",
+    "mediapackagevod",
+    "mediastore",
+    "mediatailor",
+    "meteringmarketplace",
+    "mobile",
+    "mq",
+    "neptune",
+    "networkmanager",
+    "opsworks",
+    "organizations",
+    "outposts",
+    "personalize",
+    "pi",
+    "pinpoint",
+    "pinpointemail",
+    "pinpointsmsvoice",
+    "polly",
+    "pricing",
+    "qldb",
+    "quicksight",
+    "ram",
+    "rds",
+    "redshift",
+    "resourcegroups",
+    "robomaker",
+    "route53",
+    "route53domains",
+    "route53resolver",
+    "s3",
+    "s3control",
+    "sagemaker",
+    "savingsplans",
+    "secretsmanager",
+    "securityhub",
+    "serverlessapplicationrepository",
+    "servicecatalog",
+    "servicediscovery",
+    "servicequotas",
+    "ses",
+    "sesv2",
+    "sfn",
+    "shield",
+    "simpledb",
+    "sms",
+    "snowball",
+    "sns",
+    "sqs",
+    "ssm",
+    "storagegateway",
+    "sts",
+    "support",
+    "swf",
+    "transcribeservice",
+    "transfer",
+    "waf",
+    "wafv2",
+    "workdocs",
+    "worklink",
+    "workmail",
+    "workspaces",
+    "xray",
+  ]
+  description = "Set of AWS Go SDK service labels"
+  type        = set(string)
+}
+
+resource "github_issue_label" "service" {
+  for_each = var.service_labels
+
+  repository = "terraform-provider-aws"
+  name       = "service/${each.value}"
+  color      = "bfd4f2"
+}
diff --git a/infrastructure/repository/labels-workflow.tf b/infrastructure/repository/labels-workflow.tf
new file mode 100644
index 000000000000..8a4709501476
--- /dev/null
+++ b/infrastructure/repository/labels-workflow.tf
@@ -0,0 +1,17 @@
+variable "workflow_labels" {
+  default = {
+    "hacktoberfest"                  = "2c0fad",
+    "needs-triage"                   = "e236d7",
+    "terraform-plugin-sdk-migration" = "fad8c7",
+  }
+  description = "Name-color mapping of workflow issues"
+  type        = map(string)
+}
+
+resource "github_issue_label" "workflow" {
+  for_each = var.workflow_labels
+
+  repository = "terraform-provider-aws"
+  name       = each.key
+  color      = each.value
+}
diff --git a/infrastructure/repository/main.tf b/infrastructure/repository/main.tf
new file mode 100644
index 000000000000..f2768d87538b
--- /dev/null
+++ b/infrastructure/repository/main.tf
@@ -0,0 +1,15 @@
+terraform {
+  backend "atlas" {
+    name = "hashicorp-v2/terraform-provider-aws-repository"
+  }
+
+  required_providers {
+    github = "2.1.0"
+  }
+
+  required_version = "~> 0.12.24"
+}
+
+provider "github" {
+  organization = "terraform-providers"
+}