EC2 / Client / modify_account_vpc_encryption_control

modify_account_vpc_encryption_control

EC2.Client.modify_account_vpc_encryption_control(**kwargs)

Modifies the account-level VPC Encryption Control configuration. This sets the encryption control mode and resource exclusions that apply to the VPCs in your account. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements.

For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

See also: AWS API Documentation

Request Syntax

response = client.modify_account_vpc_encryption_control(
    DryRun=True|False,
    Mode='unmanaged'|'attempt-monitor'|'attempt-enforce',
    InternetGateway='enable'|'disable',
    EgressOnlyInternetGateway='enable'|'disable',
    NatGateway='enable'|'disable',
    VirtualPrivateGateway='enable'|'disable',
    VpcPeering='enable'|'disable',
    Lambda='enable'|'disable',
    VpcLattice='enable'|'disable',
    ElasticFileSystem='enable'|'disable'
)
Parameters:

  • DryRun (boolean) – Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • Mode (string) – The encryption mode for the account encryption control configuration.

  • InternetGateway (string) – Specifies whether to exclude internet gateway resource from account-level encryption enforcement.

  • EgressOnlyInternetGateway (string) – Specifies whether to exclude egress-only internet gateway resource from account-level encryption enforcement.

  • NatGateway (string) – Specifies whether to exclude NAT gateway resource from account-level encryption enforcement.

  • VirtualPrivateGateway (string) – Specifies whether to exclude virtual private gateway resource from account-level encryption enforcement.

  • VpcPeering (string) – Specifies whether to exclude VPC peering connection resource from account-level encryption enforcement.

  • Lambda (string) – Specifies whether to exclude Lambda service from account-level encryption enforcement.

  • VpcLattice (string) – Specifies whether to exclude VPC Lattice service from account-level encryption enforcement.

  • ElasticFileSystem (string) – Specifies whether to exclude Elastic File System service from account-level encryption enforcement.

Return type:

dict

Returns:

Response Syntax

{
    'AccountVpcEncryptionControl': {
        'State': 'default-state'|'transitions-in-progress'|'transitions-partially-successful'|'transitions-successful'|'transitions-failed',
        'Mode': 'unmanaged'|'attempt-monitor'|'attempt-enforce',
        'Exclusions': {
            'InternetGateway': 'enabling'|'enabled'|'disabling'|'disabled',
            'EgressOnlyInternetGateway': 'enabling'|'enabled'|'disabling'|'disabled',
            'NatGateway': 'enabling'|'enabled'|'disabling'|'disabled',
            'VirtualPrivateGateway': 'enabling'|'enabled'|'disabling'|'disabled',
            'VpcPeering': 'enabling'|'enabled'|'disabling'|'disabled',
            'Lambda': 'enabling'|'enabled'|'disabling'|'disabled',
            'VpcLattice': 'enabling'|'enabled'|'disabling'|'disabled',
            'ElasticFileSystem': 'enabling'|'enabled'|'disabling'|'disabled'
        },
        'ManagedBy': 'account'|'declarative-policy',
        'LastUpdateTimestamp': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) –

    • AccountVpcEncryptionControl (dict) –

      Information about the account-level VPC Encryption Control configuration.

      • State (string) –

        The current state of the account-level VPC Encryption Control configuration.

      • Mode (string) –

        The encryption mode for the account-level VPC Encryption Control configuration.

      • Exclusions (dict) –

        Information about the traffic exclusions for the account-level VPC Encryption Control configuration.

        • InternetGateway (string) –

          The exclusion configuration for internet gateway resource.

        • EgressOnlyInternetGateway (string) –

          The exclusion configuration for egress-only internet gateway resource.

        • NatGateway (string) –

          The exclusion configuration for NAT gateway resource.

        • VirtualPrivateGateway (string) –

          The exclusion configuration for virtual private gateway resource.

        • VpcPeering (string) –

          The exclusion configuration for VPC peering connection resource.

        • Lambda (string) –

          The exclusion configuration for Lambda service.

        • VpcLattice (string) –

          The exclusion configuration for VPC Lattice service.

        • ElasticFileSystem (string) –

          The exclusion configuration for Elastic File System service.

      • ManagedBy (string) –

        The entity that manages the account-level VPC Encryption Control configuration.

      • LastUpdateTimestamp (datetime) –

        The date and time when the account-level VPC Encryption Control configuration was last updated.