EC2 / Client / create_mac_system_integrity_protection_modification_task

create_mac_system_integrity_protection_modification_task¶

EC2.Client.create_mac_system_integrity_protection_modification_task(**kwargs)¶

Creates a System Integrity Protection (SIP) modification task to configure the SIP settings for an x86 Mac instance or Apple silicon Mac instance. For more information, see Configure SIP for Amazon EC2 instances in the Amazon EC2 User Guide.

When you configure the SIP settings for your instance, you can either enable or disable all SIP settings, or you can specify a custom SIP configuration that selectively enables or disables specific SIP settings.

Note

If you implement a custom configuration, connect to the instance and verify the settings to ensure that your requirements are properly implemented and functioning as intended.

SIP configurations might change with macOS updates. We recommend that you review custom SIP settings after any macOS version upgrade to ensure continued compatibility and proper functionality of your security configurations.

To enable or disable all SIP settings, use the MacSystemIntegrityProtectionStatus parameter only. For example, to enable all SIP settings, specify the following:

MacSystemIntegrityProtectionStatus=enabled

To specify a custom configuration that selectively enables or disables specific SIP settings, use the MacSystemIntegrityProtectionStatus parameter to enable or disable all SIP settings, and then use the MacSystemIntegrityProtectionConfiguration parameter to specify exceptions. In this case, the exceptions you specify for MacSystemIntegrityProtectionConfiguration override the value you specify for MacSystemIntegrityProtectionStatus. For example, to enable all SIP settings, except NvramProtections, specify the following:

MacSystemIntegrityProtectionStatus=enabled
MacSystemIntegrityProtectionConfigurationRequest "NvramProtections=disabled"

Request Syntax

response = client.create_mac_system_integrity_protection_modification_task(
    ClientToken='string',
    DryRun=True|False,
    InstanceId='string',
    MacCredentials='string',
    MacSystemIntegrityProtectionConfiguration={
        'AppleInternal': 'enabled'|'disabled',
        'BaseSystem': 'enabled'|'disabled',
        'DebuggingRestrictions': 'enabled'|'disabled',
        'DTraceRestrictions': 'enabled'|'disabled',
        'FilesystemProtections': 'enabled'|'disabled',
        'KextSigning': 'enabled'|'disabled',
        'NvramProtections': 'enabled'|'disabled'
    },
    MacSystemIntegrityProtectionStatus='enabled'|'disabled',
    TagSpecifications=[
        {
            'ResourceType': 'capacity-reservation'|'client-vpn-endpoint'|'customer-gateway'|'carrier-gateway'|'coip-pool'|'declarative-policies-report'|'dedicated-host'|'dhcp-options'|'egress-only-internet-gateway'|'elastic-ip'|'elastic-gpu'|'export-image-task'|'export-instance-task'|'fleet'|'fpga-image'|'host-reservation'|'image'|'image-usage-report'|'import-image-task'|'import-snapshot-task'|'instance'|'instance-event-window'|'internet-gateway'|'ipam'|'ipam-pool'|'ipam-scope'|'ipv4pool-ec2'|'ipv6pool-ec2'|'key-pair'|'launch-template'|'local-gateway'|'local-gateway-route-table'|'local-gateway-virtual-interface'|'local-gateway-virtual-interface-group'|'local-gateway-route-table-vpc-association'|'local-gateway-route-table-virtual-interface-group-association'|'natgateway'|'network-acl'|'network-interface'|'network-insights-analysis'|'network-insights-path'|'network-insights-access-scope'|'network-insights-access-scope-analysis'|'outpost-lag'|'placement-group'|'prefix-list'|'replace-root-volume-task'|'reserved-instances'|'route-table'|'security-group'|'security-group-rule'|'service-link-virtual-interface'|'snapshot'|'spot-fleet-request'|'spot-instances-request'|'subnet'|'subnet-cidr-reservation'|'traffic-mirror-filter'|'traffic-mirror-session'|'traffic-mirror-target'|'transit-gateway'|'transit-gateway-attachment'|'transit-gateway-connect-peer'|'transit-gateway-multicast-domain'|'transit-gateway-policy-table'|'transit-gateway-route-table'|'transit-gateway-route-table-announcement'|'volume'|'vpc'|'vpc-endpoint'|'vpc-endpoint-connection'|'vpc-endpoint-service'|'vpc-endpoint-service-permission'|'vpc-peering-connection'|'vpn-connection'|'vpn-gateway'|'vpc-flow-log'|'capacity-reservation-fleet'|'traffic-mirror-filter-rule'|'vpc-endpoint-connection-device-type'|'verified-access-instance'|'verified-access-group'|'verified-access-endpoint'|'verified-access-policy'|'verified-access-trust-provider'|'vpn-connection-device-type'|'vpc-block-public-access-exclusion'|'route-server'|'route-server-endpoint'|'route-server-peer'|'ipam-resource-discovery'|'ipam-resource-discovery-association'|'instance-connect-endpoint'|'verified-access-endpoint-target'|'ipam-external-resource-verification-token'|'capacity-block'|'mac-modification-task'|'ipam-prefix-list-resolver'|'ipam-prefix-list-resolver-target'|'capacity-manager-data-export',
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ]
        },
    ]
)

Parameters:

ClientToken (string) –
Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. For more information, see Ensuring Idempotency.

This field is autopopulated if not provided.
DryRun (boolean) – Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
InstanceId (string) –
[REQUIRED]

The ID of the Amazon EC2 Mac instance.
MacCredentials (string) –
[Apple silicon Mac instances only] Specifies the following credentials:
- Internal disk administrative user
  - Username - Only the default administrative user ( aws-managed-user) is supported and it is used by default. You can’t specify a different administrative user.
  - Password - If you did not change the default password for aws-managed-user, specify the default password, which is blank. Otherwise, specify your password.
- Amazon EBS root volume administrative user
  - Username - If you did not change the default administrative user, specify ec2-user. Otherwise, specify the username for your administrative user.
  - Password - Specify the password for the administrative user.
The credentials must be specified in the following JSON format:

{ "internalDiskPassword":"internal-disk-admin_password", "rootVolumeUsername":"root-volume-admin_username", "rootVolumepassword":"root-volume-admin_password" }
MacSystemIntegrityProtectionConfiguration (dict) –
Specifies the overrides to selectively enable or disable individual SIP settings. The individual settings you specify here override the overall SIP status you specify for MacSystemIntegrityProtectionStatus.
- AppleInternal (string) –
  
  Enables or disables Apple Internal.
- BaseSystem (string) –
  
  Enables or disables Base System.
- DebuggingRestrictions (string) –
  
  Enables or disables Debugging Restrictions.
- DTraceRestrictions (string) –
  
  Enables or disables Dtrace Restrictions.
- FilesystemProtections (string) –
  
  Enables or disables Filesystem Protections.
- KextSigning (string) –
  
  Enables or disables Kext Signing.
- NvramProtections (string) –
  
  Enables or disables Nvram Protections.
MacSystemIntegrityProtectionStatus (string) –
[REQUIRED]

Specifies the overall SIP status for the instance. To enable all SIP settings, specify enabled. To disable all SIP settings, specify disabled.
TagSpecifications (list) –
Specifies tags to apply to the SIP modification task.
- (dict) –
  
  The tags to apply to a resource when the resource is being created. When you specify a tag, you must specify the resource type to tag, otherwise the request will fail.
  
  Note
  The Valid Values lists all the resource types that can be tagged. However, the action you’re using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you’re using, you’ll get an error.
  - ResourceType (string) –
    
    The type of resource to tag on creation.
  - Tags (list) –
    
    The tags to apply to the resource.
    - (dict) –
      
      Describes a tag.
      - Key (string) –
        
        The key of the tag.
        
        Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:.
      - Value (string) –
        
        The value of the tag.
        
        Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.

Return type:

dict

Returns:

Response Syntax

{
    'MacModificationTask': {
        'InstanceId': 'string',
        'MacModificationTaskId': 'string',
        'MacSystemIntegrityProtectionConfig': {
            'AppleInternal': 'enabled'|'disabled',
            'BaseSystem': 'enabled'|'disabled',
            'DebuggingRestrictions': 'enabled'|'disabled',
            'DTraceRestrictions': 'enabled'|'disabled',
            'FilesystemProtections': 'enabled'|'disabled',
            'KextSigning': 'enabled'|'disabled',
            'NvramProtections': 'enabled'|'disabled',
            'Status': 'enabled'|'disabled'
        },
        'StartTime': datetime(2015, 1, 1),
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'TaskState': 'successful'|'failed'|'in-progress'|'pending',
        'TaskType': 'sip-modification'|'volume-ownership-delegation'
    }
}

Response Structure

(dict) –
- MacModificationTask (dict) –
  
  Information about the SIP modification task.
  - InstanceId (string) –
    
    The ID of the Amazon EC2 Mac instance.
  - MacModificationTaskId (string) –
    
    The ID of task.
  - MacSystemIntegrityProtectionConfig (dict) –
    
    [SIP modification tasks only] Information about the SIP configuration.
    - AppleInternal (string) –
      
      Indicates whether Apple Internal was enabled or disabled by the task.
    - BaseSystem (string) –
      
      Indicates whether Base System was enabled or disabled by the task.
    - DebuggingRestrictions (string) –
      
      Indicates whether Debugging Restrictions was enabled or disabled by the task.
    - DTraceRestrictions (string) –
      
      Indicates whether Dtrace Restrictions was enabled or disabled by the task.
    - FilesystemProtections (string) –
      
      Indicates whether Filesystem Protections was enabled or disabled by the task.
    - KextSigning (string) –
      
      Indicates whether Kext Signing was enabled or disabled by the task.
    - NvramProtections (string) –
      
      Indicates whether NVRAM Protections was enabled or disabled by the task.
    - Status (string) –
      
      Indicates SIP was enabled or disabled by the task.
  - StartTime (datetime) –
    
    The date and time the task was created, in the UTC timezone ( YYYY-MM-DDThh:mm:ss.sssZ).
  - Tags (list) –
    
    The tags assigned to the task.
    - (dict) –
      
      Describes a tag.
      - Key (string) –
        
        The key of the tag.
        
        Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:.
      - Value (string) –
        
        The value of the tag.
        
        Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.
  - TaskState (string) –
    
    The state of the task.
  - TaskType (string) –
    
    The type of task.

create_mac_system_integrity_protection_modification_task¶

Note

Request Syntax

Internal disk administrative user

Amazon EBS root volume administrative user

Note

Response Syntax

Response Structure