Does Amazon CloudWatch Work in China? Data Residency for Your Logs & Metrics
Amazon CloudWatch stores your logs, metrics and traces in the AWS Region you send them to — and on a global AWS account that Region is outside mainland China. Because monitoring data routinely carries personal information, that is a PIPL cross-border-transfer question, not a speed one. A compliance-first look at where your telemetry lives.
Does Amazon CloudWatch work in China?
You can reach CloudWatch from inside China — but on your global AWS account it stores your logs, metrics and traces outside the mainland, and that telemetry routinely carries personal data. Whether CloudWatch "works" here is a data-residency question, not a speed one.
AWS's own CloudWatch Logs data-protection feature exists precisely because monitoring data carries personal information: it detects and masks "Personally Identifiable Information (PII) such as driver's licenses or social security numbers" and "Device identifiers, such as IP addresses or MAC addresses." CloudWatch holds that data in the AWS Region you send it to, and AWS offers it inside China only as the separate China (Beijing) and China (Ningxia) regions — operated by Sinnet and NWCD on credentials that "will not be able to access resources" across the two partitions. Serve China from a global account and your users' telemetry sits offshore: a cross-border transfer of personal information PIPL governs. The table below is AWS's own wording and the rule each line triggers.
This is a risk map, not a verdict — what applies turns on your entity, your data volumes and whose data your logs capture. Our China team can map your exposure with you →
Compliance snapshot
- ! On global AWS, your CloudWatch logs and metrics are stored outside the mainland
- ! Logs and traces routinely carry PII — AWS itself masks IPs and user IDs in them
- ! China users' telemetry crossing the border is a PIPL cross-border transfer
- ✓ CloudWatch has no public site, so it carries no ICP filing of its own
- ! 'Use AWS China' is a separate account, operator and regime — not a toggle
What Amazon Cloudwatch's own documentation says about China
| Fact | Primary source |
|---|---|
| By AWS's own account, CloudWatch logs routinely carry personal information. AWS built a CloudWatch Logs data-protection feature specifically to "audit and mask sensitive data that appears in log events," and lists what it finds: "Personally Identifiable Information (PII) such as driver's licenses or social security numbers," "Protected Health Information (PHI)," financial data, and "Device identifiers, such as IP addresses or MAC addresses." Logs and traces are not anonymous telemetry — they are a store of personal data, which is what makes where they live a PIPL question. | Amazon CloudWatch Logs — Help protect sensitive log data with masking (docs.aws.amazon.com), retrieved 2026-10-07 |
| CloudWatch keeps your telemetry in the Region you send it to — and on a global account that Region is outside mainland China. CloudWatch is a per-Region service; AWS offers it inside China only as the separate "China (Beijing)" and "China (Ningxia)" regions. Telemetry from Chinese users stored in a non-China Region is a cross-border transfer under PIPL — notice, separate consent and a transfer mechanism (Articles 38–43) — and for a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Amazon Web Services in China — CloudWatch region availability (docs.amazonaws.cn), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| "Use AWS China" is a separate account, a separate operator and a separate compliance regime — not a region toggle. In AWS's own words, "Sinnet" operates the Beijing Region and "NWCD" the Ningxia Region; you "sign up for a separate set of account credentials," and "customers with existing Amazon Web Services Inc. credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa." Registering needs "a valid Chinese business license issued by the Bureau of Industry and Commerce." Moving CloudWatch in-country means standing up that whole separate footing. | Amazon Web Services in China — FAQs (amazonaws.cn), retrieved 2026-10-07 |
| CloudWatch carries no ICP filing of its own — that door belongs to the app it watches. CloudWatch is backend observability with no public-facing website, so the ICP filing a mainland site requires (State Council Order No. 292; MIIT Order No. 33) attaches to the internet information service your application provides to the public, not to its telemetry. The honest CloudWatch question is therefore not ICP but residency: where the monitoring data — and the personal information inside it — is allowed to sit. | 21YunBox compliance reading — ICP regime (State Council Order No. 292; MIIT Order No. 33); Amazon CloudWatch product scope (aws.amazon.com/cloudwatch), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about Amazon CloudWatch is not whether its dashboards load — it is where the data behind them is allowed to live. CloudWatch keeps your logs, metrics and traces in the AWS Region you send them to, and on the global AWS account most teams run, that Region sits outside mainland China. Because logs and traces routinely capture personal information — IP addresses, user identifiers, request and response payloads — sending them offshore turns CloudWatch into a cross-border data question long before it is a performance one. AWS documents each half of this in its own words.
Amazon CloudWatch in China at a glance
| What decides it | In AWS's own terms |
|---|---|
| Where the data lives | CloudWatch stores your logs, metrics and traces in the AWS Region you send them to. On a global AWS account that Region is outside mainland China; AWS offers CloudWatch inside China only as the separate China (Beijing) and China (Ningxia) regions. |
| What the data contains | AWS's own CloudWatch Logs data protection detects and masks “Personally Identifiable Information (PII) such as driver's licenses or social security numbers” and “Device identifiers, such as IP addresses or MAC addresses” — logs and traces carry personal data. |
| The China partition | “Sinnet” operates the Beijing Region and “NWCD” the Ningxia Region. You “sign up for a separate set of account credentials,” and existing credentials “will not be able to access resources in the Amazon Web Services China Regions, and vice versa.” |
| Where ICP applies | CloudWatch has no public-facing website, so no ICP filing attaches to it. ICP (State Council Order No. 292; MIIT Order No. 33) falls on the application CloudWatch monitors, not on the telemetry. |
| Cross-border exposure | Chinese users' telemetry held offshore is a cross-border transfer of personal information under PIPL; for a CIIO or large-volume handler, in-China storage is required (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). |
The data behind the dashboard is what crosses the border
CloudWatch is a regional service: every log group, metric and trace lands in the AWS Region you publish it to and stays there unless you move it. On the global AWS account most teams run, that Region is in the United States, Europe or elsewhere offshore — never the mainland. Normally that is unremarkable. It stops being unremarkable the moment the telemetry describes Chinese users, because AWS’s own documentation concedes what logs contain: its CloudWatch Logs data-protection feature exists to “audit and mask sensitive data that appears in log events,” and the sensitive data it recognizes includes “Personally Identifiable Information (PII) such as driver’s licenses or social security numbers” and “Device identifiers, such as IP addresses or MAC addresses.” Request paths, headers, user IDs and error payloads carry still more.
Shipping that offshore is, under China’s Personal Information Protection Law, a cross-border transfer of personal information — and the handler, you rather than AWS, has to give notice, obtain separate consent and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) under Articles 38–43. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty an offshore CloudWatch Region cannot meet. The dashboards are beside the point; it is the stored data behind them that the law reaches.
”Use AWS China” is a separate account and operator, not a toggle
The obvious reply — “then send CloudWatch to a China region” — is not the small change it sounds like. AWS runs its mainland regions as a distinct partition operated by Chinese companies: in its own words “Sinnet” operates the Beijing Region and “NWCD” the Ningxia Region. To use them you “sign up for a separate set of account credentials,” and “customers with existing Amazon Web Services Inc. credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa.” Registering that account requires “a valid Chinese business license issued by the Bureau of Industry and Commerce.” So moving your observability in-country is not a drop-down change; it is a Chinese legal entity, a second AWS account under a different contracting party, and a compliance regime of its own — the same footing any mainland workload needs, now applied to your monitoring stack.
Where the ICP line actually falls
It is worth being precise about which door CloudWatch does and does not open. CloudWatch is backend telemetry with no public-facing website, so it carries no ICP filing of its own — the ICP regime under State Council Order No. 292 and MIIT Order No. 33 governs the internet information service your application provides to the public, not the logs and metrics behind it. Forcing ICP onto CloudWatch itself would be the wrong frame. The honest CloudWatch question is narrower and sits one layer down: where the monitoring data lives, and whether the personal information inside it is allowed to sit there. That is a residency and cross-border question, and it is the one that actually decides whether your setup is defensible.
This is a risk map, not a verdict: whether a cross-border mechanism, in-country storage, or both apply to your logs turns on what your telemetry captures, how much of it is personal information, and whose data it is — worth settling with counsel before you wire it up.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running CloudWatch, and the rest of your AWS monitoring, exactly where it is. What we add is the piece a global observability stack cannot give you on its own: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing origin — no rebuild, no second codebase, and no fork of your telemetry pipeline. Our China team maps where your monitoring data resides, assesses your PIPL cross-border and data-residency exposure against your entity and data volumes, and stands up the in-country delivery and storage a lawful China presence needs, while CloudWatch keeps doing its job on the stack you already run.
Related reading:
Frequently Asked Questions
Does our existing AWS account's CloudWatch reach into mainland China?
Not as the same thing. CloudWatch stores data per-Region, and AWS offers it in China only through the separate China (Beijing) and China (Ningxia) regions, operated by Sinnet and NWCD. AWS states that existing Amazon Web Services credentials "will not be able to access resources in the Amazon Web Services China Regions, and vice versa," and registering a China account requires a valid Chinese business license. On your global account, CloudWatch telemetry simply stays in whichever non-China Region you send it to.
Is it a problem to monitor Chinese users from global CloudWatch?
Treat it as a risk to assess with counsel, not a yes/no. Logs and traces routinely capture personal information — AWS's own data-protection tooling exists to mask PII, IP addresses and the like — so sending that telemetry to a Region outside the mainland is a cross-border transfer of personal information under PIPL, which calls for notice, separate consent and a transfer mechanism. Whether an in-China storage duty also applies turns on your role (for example, a critical information infrastructure operator) and your data volumes.
Can 21YunBox help make our observability setup compliant in China?
Yes. Our China team can assess where your CloudWatch telemetry lives and the PIPL cross-border and data-residency exposure that creates for your entity, data volumes and users — and stand up the ICP-filed, in-country delivery your public application needs, while your CloudWatch and AWS monitoring stay exactly where they are. Get in touch to work through your specific case.
