Does AWS Amplify Work in China? ICP, PIPL & the Two Doors
AWS Amplify can deploy your app for China, but a standard AWS account has no mainland-China Region — so a public Amplify site can't be ICP-filed, and the user data in its authentication, data and storage backend sits offshore under PIPL. A compliance-first look at the two doors.
Does AWS Amplify work in China?
AWS Amplify will build, deploy and run your app for mainland-China visitors — yet it clears neither of the two doors that decide whether you may operate there. A public Amplify site has no mainland Region to ICP-file against, and the user data in its backend sits offshore under PIPL.
Amplify is, in AWS's words, "everything you need to build web and mobile apps": it hosts your frontend "backed by Amazon CloudFront's content delivery network (CDN)" and provisions the backend — authentication, data and storage — that holds your users' accounts, profiles and files. Served to China from a standard global AWS account, that frontend has no mainland-China Region to attach an ICP filing to, and the personal information in the backend is stored outside the mainland: a cross-border transfer PIPL governs. AWS does run inside the mainland, but only as a separate partition operated by Sinnet and NWCD, on a distinct China account with its own ICP — not a switch on the account you already have. The table below is AWS's own wording and the rule each door triggers.
This is a risk map, not a verdict — which door applies turns on your entity, your data and who your users are. Our China team can map your exposure with you →
Compliance snapshot
- ✕ A public app served from offshore Amplify can't be ICP-filed
- ! Amplify's backend stores user data — offshore, PIPL governs the transfer
- ! No mainland-China Amplify Region on a standard AWS account
- ! AWS China is a separate account, operator and ICP filing — not a toggle
- ✓ AWS China Regions do keep data in-country — via a Chinese entity
What AWS Amplify's own documentation says about China
| Fact | Primary source |
|---|---|
| Amplify is a full-stack platform, so it holds both halves of the problem — your frontend and your users' data. AWS calls Amplify "everything you need to build web and mobile apps" and pitches going "from frontend to fullstack": it hosts the web and mobile frontend and provisions the backend — authentication ("Enable secure authentication flows and control access to data, files, and more"), data ("Build secure, real-time APIs backed by AWS databases") and storage ("Store and manage app content and data"). That backend is where your users' personal information lives. | AWS Amplify product page (aws.amazon.com/amplify), retrieved 2026-10-07 |
| Amplify Hosting serves from a global, offshore CDN — which leaves nothing in the mainland to ICP-file. AWS describes Amplify Hosting as distributing your app "backed by Amazon CloudFront's content delivery network (CDN)." A public site served to mainland visitors turns on an ICP filing (State Council Order No. 292; MIIT Order No. 33) bound to a hosting resource physically inside China — and an offshore edge cannot carry one. | AWS Amplify Hosting (aws.amazon.com/amplify/hosting), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| On a standard AWS account, Amplify has no mainland-China Region. AWS's own "AWS Amplify endpoints and quotas" reference lists the Regions where Amplify runs — across the US, Canada, Europe, the Middle East, South America and Asia Pacific (the nearest being Hong Kong, Singapore and Tokyo) — and not one is inside mainland China. So a global Amplify app reaches China only from offshore edges, with no in-country Region to file an ICP against or to store data in. | AWS General Reference — AWS Amplify endpoints and quotas (docs.aws.amazon.com), retrieved 2026-10-07 |
| AWS does run in mainland China — but as a separate partition, not a setting you flip. In AWS's own words, China customers "are required to sign up for a separate set of account credentials," existing global "credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa," and the Regions are "operated" by Chinese partners — Beijing by Sinnet, Ningxia by NWCD. Registering needs "a valid Chinese business license issued by the Bureau of Industry and Commerce." Taking an Amplify app there is a different entity, account and ICP filing — not a toggle. | Amazon Web Services in China — FAQs (amazonaws.cn), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Keep the backend on a global account and your users' data is a cross-border transfer. Because AWS's Amplify endpoints reference lists no mainland-China Region, the accounts, profiles and files Amplify stores for your China users sit in a non-China Region — personal information leaving the mainland. PIPL governs that as a cross-border transfer (notice, separate consent and a transfer mechanism, Articles 38–43); for a critical information infrastructure operator or a large-volume handler it must instead be stored in China (Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | AWS General Reference — AWS Amplify endpoints and quotas (docs.aws.amazon.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about AWS Amplify is not how quickly it paints — it is whether you are cleared to serve from it, and whether your users’ data is allowed to live where Amplify keeps it. Amplify is a full-stack platform: it hosts your frontend on AWS’s global edge and runs the backend that stores your users’ accounts, profiles and files. Point that at China from a standard AWS account and two things follow that no amount of tuning changes — the public site has no mainland Region to hang an ICP filing on, and the personal data in the backend becomes a cross-border transfer China’s law governs. AWS does operate inside the mainland, but only through a separate, partner-run partition you reach with a Chinese entity and a brand-new account. Reaching Amplify is the easy half; the licensing and the data residency are the exposure.
cn-north-1 (Beijing) and cn-northwest-1 (Ningxia) are absent, because they sit in a separate AWS account you reach through a different operator. On a standard AWS account there is no mainland Region to file an ICP against. Source: docs.aws.amazon.com — AWS Amplify endpoints and quotasAWS Amplify in China at a glance
| What decides it | In AWS Amplify's own terms |
|---|---|
| Where it runs | Amplify runs in AWS's global Regions — US, Canada, Europe, the Middle East, South America and Asia Pacific (nearest: Hong Kong, Singapore, Tokyo). AWS's own endpoints reference lists no mainland-China Region on a standard account. |
| How it's delivered | The frontend is served “backed by Amazon CloudFront's content delivery network (CDN)” — a global edge network. On a standard account that edge reaches China from offshore, not from inside the mainland. |
| Serving the public | A site served to mainland visitors needs an ICP filing tied to in-country hosting. With no mainland Region on your account, Amplify offers no footing of its own to file against. |
| Your users' data | Amplify's backend — authentication, data and storage — holds accounts, profiles and uploads. On a global account that personal information sits offshore: a cross-border transfer PIPL governs, with a residency duty for CIIOs and large-volume handlers. |
| AWS inside China | AWS runs in the mainland only as a separate partition — Beijing “operated” by Sinnet, Ningxia by NWCD — on a “separate set of account credentials” your existing ones cannot access, requiring a Chinese business license and its own ICP. |
Door one — a public Amplify site has no mainland footing to ICP-file
Amplify Hosting delivers your frontend from AWS’s global edge: in AWS’s words, “backed by Amazon CloudFront’s content delivery network (CDN).” That edge is everywhere except the one place that matters here — on a standard AWS account there is no mainland-China Amplify Region at all. AWS’s own “AWS Amplify endpoints and quotas” reference lists where the service runs — the US, Canada, Europe, the Middle East, South America and Asia Pacific, the closest being Hong Kong, Singapore and Tokyo — and not a single entry sits inside mainland China.
That settles the licensing question before performance enters it. A public-facing website delivered to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to attach to a hosting resource physically located in the mainland. A standard Amplify app has none, so there is nothing on it to file against. This is where “we already build on Amplify” runs out: reaching China from an offshore CloudFront edge is not the same as being cleared to operate there, and no build setting conjures the in-country footing a filing requires.
Door two — Amplify’s backend puts your users’ data offshore
Amplify is not only hosting. AWS pitches it as a way to go “from frontend to fullstack,” provisioning a backend that handles “secure authentication flows,” “secure, real-time APIs backed by AWS databases,” and storage to “store and manage app content and data.” In practice those features sit on familiar AWS services — Amazon Cognito for auth, AWS AppSync and Amazon DynamoDB for data, Amazon S3 for storage — and together they hold exactly the material China’s privacy law cares about: your users’ accounts, profiles and uploads.
Run that backend on a global account and the personal information of your Chinese users lives in a non-China Region — outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not AWS — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore AWS Region cannot meet.
AWS inside China is a separate partition, not a toggle
AWS does run inside the mainland — through the Beijing (cn-north-1) and Ningxia (cn-northwest-1) Regions — but that partition is walled off from the account you already have. In AWS’s own words, China customers “are required to sign up for a separate set of account credentials,” existing global “credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa,” and the Regions are run by Chinese partners: Beijing “operated” by Sinnet, Ningxia by NWCD. To register, a company must supply “a valid Chinese business license issued by the Bureau of Industry and Commerce,” and a public site there still needs its own ICP filed through the operator.
So even the in-country route is not a switch on your Amplify app. It is a different contracting party, a different account, a Chinese legal entity, and an ICP filing — and whether the China partition even offers the Amplify features your app depends on is a question to confirm against that partition’s own documentation, not an assumption carried over from global AWS.
This is a risk map, not a verdict: whether you need an ICP filing, in-country data storage, or both, turns on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Keep shipping with Amplify exactly as you do now — the same repository, the same build, the same authentication, data and storage backend. What Amplify leaves you to arrange on your own, we add: lawful, ICP-filed delivery from inside the mainland, set in front of the origin Amplify already serves — no rebuild, no parallel codebase, and no second cloud to run. Our China team works out which door is yours, weighs your ICP exposure for the public app and your PIPL cross-border and residency exposure for the backend, and brings up the in-country delivery a compliant China presence depends on, while your Amplify stack stays right where it is.
Related reading:
Frequently Asked Questions
Can we just add a China region to our existing AWS Amplify app?
Not by flipping a setting. On a standard AWS account Amplify has no mainland-China Region — AWS's endpoints reference lists none — so a global Amplify app reaches China only from offshore edges. AWS runs inside the mainland only as a separate partition operated by Sinnet (Beijing) and NWCD (Ningxia), on a distinct China account that AWS says existing credentials "will not be able to access," and that account requires a valid Chinese business license. It is a different entity and contract, not a region toggle.
Is it a problem that our user data lives in Amplify's backend?
It can be. Amplify's backend — authentication, data and storage — holds your users' accounts, profiles and uploads. Served from a global AWS account, that personal information sits outside mainland China, which PIPL treats as a cross-border transfer requiring notice, separate consent and a transfer mechanism (Articles 38–43). If you are a critical information infrastructure operator or handle large volumes, the data may instead have to stay in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Treat it as a risk to confirm with counsel, not a blanket yes or no.
Can 21YunBox help make our AWS Amplify app work in China?
Yes. Our China team can map which door applies — assessing your ICP exposure for the public app and your PIPL cross-border and data-residency exposure for the backend, against your entity, data volumes and users — and stand up the ICP-filed, in-country delivery a compliant China presence needs, in front of the Amplify stack you already run. Get in touch to work through your specific case.
