create_mac_system_integrity_protection_modification_task ¶

def create_mac_system_integrity_protection_modification_task(
    self,
    *,
    config_overrides: Optional[EC2ClientConfig] = None,
    client_token: Optional["capo_ec2.types.string.String"] = None,
    dry_run: Optional["capo_ec2.types.boolean.Boolean"] = None,
    instance_id: Optional["capo_ec2.types.instance_id.InstanceId"] = None,
    mac_credentials: Optional[
        "capo_ec2.types.sensitive_mac_credentials.SensitiveMacCredentials"
    ] = None,
    mac_system_integrity_protection_configuration: Optional[
        "capo_ec2.types.mac_system_integrity_protection_configuration_request.MacSystemIntegrityProtectionConfigurationRequest"
    ] = None,
    mac_system_integrity_protection_status: Optional[
        "capo_ec2.types.mac_system_integrity_protection_setting_status.MacSystemIntegrityProtectionSettingStatus"
    ] = None,
    tag_specifications: Optional[
        "capo_ec2.types.tag_specification_list.TagSpecificationList"
    ] = None,
) -> "capo_ec2.types.create_mac_system_integrity_protection_modification_task_result.CreateMacSystemIntegrityProtectionModificationTaskResult":
    """<p>Creates a System Integrity Protection (SIP) modification task to configure the SIP settings for an x86 Mac instance or Apple silicon Mac instance. For more information, see <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/mac-sip-settings.html#mac-sip-configure"> Configure SIP for Amazon EC2 instances</a> in the <i>Amazon EC2 User Guide</i>.</p> <p>When you configure the SIP settings for your instance, you can either enable or disable all SIP settings, or you can specify a custom SIP configuration that selectively enables or disables specific SIP settings.</p> <note> <p>If you implement a custom configuration, <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/mac-sip-settings.html#mac-sip-check-settings"> connect to the instance and verify the settings</a> to ensure that your requirements are properly implemented and functioning as intended.</p> <p>SIP configurations might change with macOS updates. We recommend that you review custom SIP settings after any macOS version upgrade to ensure continued compatibility and proper functionality of your security configurations.</p> </note> <p>To enable or disable all SIP settings, use the <b>MacSystemIntegrityProtectionStatus</b> parameter only. For example, to enable all SIP settings, specify the following:</p> <ul> <li> <p> <code>MacSystemIntegrityProtectionStatus=enabled</code> </p> </li> </ul> <p>To specify a custom configuration that selectively enables or disables specific SIP settings, use the <b>MacSystemIntegrityProtectionStatus</b> parameter to enable or disable all SIP settings, and then use the <b>MacSystemIntegrityProtectionConfiguration</b> parameter to specify exceptions. In this case, the exceptions you specify for <b>MacSystemIntegrityProtectionConfiguration</b> override the value you specify for <b>MacSystemIntegrityProtectionStatus</b>. For example, to enable all SIP settings, except <code>NvramProtections</code>, specify the following:</p> <ul> <li> <p> <code>MacSystemIntegrityProtectionStatus=enabled</code> </p> </li> <li> <p> <code>MacSystemIntegrityProtectionConfigurationRequest "NvramProtections=disabled"</code> </p> </li> </ul>

    Args:
        client_token: <p>Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. For more information, see <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html">Ensuring Idempotency</a>.</p>
        dry_run: <p>Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is <code>DryRunOperation</code>. Otherwise, it is <code>UnauthorizedOperation</code>.</p>
        instance_id: <p>The ID of the Amazon EC2 Mac instance.</p>
        mac_credentials: <p> <b>[Apple silicon Mac instances only]</b> Specifies the following credentials:</p> <ul> <li> <p> <b>Internal disk administrative user</b> </p> <ul> <li> <p> <b>Username</b> - Only the default administrative user (<code>aws-managed-user</code>) is supported and it is used by default. You can't specify a different administrative user.</p> </li> <li> <p> <b>Password</b> - If you did not change the default password for <code>aws-managed-user</code>, specify the default password, which is <i>blank</i>. Otherwise, specify your password.</p> </li> </ul> </li> <li> <p> <b>Amazon EBS root volume administrative user</b> </p> <ul> <li> <p> <b>Username</b> - If you did not change the default administrative user, specify <code>ec2-user</code>. Otherwise, specify the username for your administrative user.</p> </li> <li> <p> <b>Password</b> - Specify the password for the administrative user.</p> </li> </ul> </li> </ul> <p>The credentials must be specified in the following JSON format:</p> <p> <code>{ "internalDiskPassword":"<i>internal-disk-admin_password</i>", "rootVolumeUsername":"<i>root-volume-admin_username</i>", "rootVolumepassword":"<i>root-volume-admin_password</i>" }</code> </p>
        mac_system_integrity_protection_configuration: <p>Specifies the overrides to selectively enable or disable individual SIP settings. The individual settings you specify here override the overall SIP status you specify for <b>MacSystemIntegrityProtectionStatus</b>.</p>
        mac_system_integrity_protection_status: <p>Specifies the overall SIP status for the instance. To enable all SIP settings, specify <code>enabled</code>. To disable all SIP settings, specify <code>disabled</code>.</p>
        tag_specifications: <p>Specifies tags to apply to the SIP modification task.</p>

    Raises:
        capo_ec2.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_ec2.types.create_mac_system_integrity_protection_modification_task_request.CreateMacSystemIntegrityProtectionModificationTaskRequest]",
    ) -> OperationResponse[
        "capo_ec2.types.create_mac_system_integrity_protection_modification_task_result.CreateMacSystemIntegrityProtectionModificationTaskResult"
    ]:
        import capo_ec2._operations.amazon_ec2.create_mac_system_integrity_protection_modification_task

        output, http_response = (
            capo_ec2._operations.amazon_ec2.create_mac_system_integrity_protection_modification_task.create_mac_system_integrity_protection_modification_task(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_ec2.types.create_mac_system_integrity_protection_modification_task_request.CreateMacSystemIntegrityProtectionModificationTaskRequest",
    ) -> dict[str, Any]:
        import capo_ec2.types.create_mac_system_integrity_protection_modification_task_request

        return capo_ec2.types.create_mac_system_integrity_protection_modification_task_request.redact_sensitive(
            input_
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "CreateMacSystemIntegrityProtectionModificationTask",
            redact_input=_redact_input,
        ),
    )
    input_: capo_ec2.types.create_mac_system_integrity_protection_modification_task_request.CreateMacSystemIntegrityProtectionModificationTaskRequest = {}
    if client_token is None:
        client_token = str(uuid.uuid4())
    input_["client_token"] = client_token
    if dry_run is not None:
        input_["dry_run"] = dry_run
    if instance_id is not None:
        input_["instance_id"] = instance_id
    if mac_credentials is not None:
        input_["mac_credentials"] = mac_credentials
    if mac_system_integrity_protection_configuration is not None:
        input_["mac_system_integrity_protection_configuration"] = (
            mac_system_integrity_protection_configuration
        )
    if mac_system_integrity_protection_status is not None:
        input_["mac_system_integrity_protection_status"] = (
            mac_system_integrity_protection_status
        )
    if tag_specifications is not None:
        input_["tag_specifications"] = tag_specifications

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output