create_mac_system_integrity_protection_modification_task¶
Operation¶
async
¶
create_mac_system_integrity_protection_modification_task(input: CreateMacSystemIntegrityProtectionModificationTaskInput, plugins: list[Plugin] | None = None) -> CreateMacSystemIntegrityProtectionModificationTaskOutput
Creates a System Integrity Protection (SIP) modification task to configure the SIP settings for an x86 Mac instance or Apple silicon Mac instance. For more information, see Configure SIP for Amazon EC2 instances in the Amazon EC2 User Guide.
When you configure the SIP settings for your instance, you can either enable or disable all SIP settings, or you can specify a custom SIP configuration that selectively enables or disables specific SIP settings.
Note
If you implement a custom configuration, connect to the instance and verify the settings to ensure that your requirements are properly implemented and functioning as intended.
SIP configurations might change with macOS updates. We recommend that you review custom SIP settings after any macOS version upgrade to ensure continued compatibility and proper functionality of your security configurations.
To enable or disable all SIP settings, use the MacSystemIntegrityProtectionStatus parameter only. For example, to enable all SIP settings, specify the following:
MacSystemIntegrityProtectionStatus=enabled
To specify a custom configuration that selectively enables or disables
specific SIP settings, use the MacSystemIntegrityProtectionStatus
parameter to enable or disable all SIP settings, and then use the
MacSystemIntegrityProtectionConfiguration parameter to specify
exceptions. In this case, the exceptions you specify for
MacSystemIntegrityProtectionConfiguration override the value you
specify for MacSystemIntegrityProtectionStatus. For example, to
enable all SIP settings, except NvramProtections, specify the
following:
-
MacSystemIntegrityProtectionStatus=enabled -
MacSystemIntegrityProtectionConfigurationRequest "NvramProtections=disabled"
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
input
|
CreateMacSystemIntegrityProtectionModificationTaskInput
|
An instance of |
required |
plugins
|
list[Plugin] | None
|
A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations. |
None
|
Returns:
| Type | Description |
|---|---|
CreateMacSystemIntegrityProtectionModificationTaskOutput
|
An instance of |
Input¶
dataclass
¶
Bases: _SerdeShape
Dataclass for CreateMacSystemIntegrityProtectionModificationTaskInput structure.
Attributes¶
class-attribute
instance-attribute
¶
client_token: str | None = ...
Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. For more information, see Ensuring Idempotency.
This field is autopopulated if not provided.
class-attribute
instance-attribute
¶
dry_run: bool | None = ...
Checks whether you have the required permissions for the action, without
actually making the request, and provides an error response. If you have
the required permissions, the error response is DryRunOperation.
Otherwise, it is UnauthorizedOperation.
class-attribute
instance-attribute
¶
instance_id: str | None = ...
The ID of the Amazon EC2 Mac instance.
class-attribute
instance-attribute
¶
mac_credentials: str | None = ...
[Apple silicon Mac instances only] Specifies the following credentials:
-
Internal disk administrative user
-
Username - Only the default administrative user (
aws-managed-user) is supported and it is used by default. You can't specify a different administrative user. -
Password - If you did not change the default password for
aws-managed-user, specify the default password, which is blank. Otherwise, specify your password. -
Amazon EBS root volume administrative user
-
Username - If you did not change the default administrative user, specify
ec2-user. Otherwise, specify the username for your administrative user. -
Password - Specify the password for the administrative user.
The credentials must be specified in the following JSON format:
{ "internalDiskPassword":"internal-disk-admin_password", "rootVolumeUsername":"root-volume-admin_username", "rootVolumepassword":"root-volume-admin_password" }
class-attribute
instance-attribute
¶
mac_system_integrity_protection_configuration: MacSystemIntegrityProtectionConfigurationRequest | None = ...
Specifies the overrides to selectively enable or disable individual SIP settings. The individual settings you specify here override the overall SIP status you specify for MacSystemIntegrityProtectionStatus.
Output¶
dataclass
¶
Bases: _SerdeShape
Dataclass for CreateMacSystemIntegrityProtectionModificationTaskOutput structure.
Attributes¶
class-attribute
instance-attribute
¶
Information about the SIP modification task.
class-attribute
instance-attribute
¶
Metadata about the response that produced this output. Use this to recover the request identifiers a service's support team needs in order to investigate a call. Members of the metadata are individually optional.