Does AWS Work in China? ICP, Data Residency & the Two Doors
AWS runs in mainland China only through a separate, partner-operated partition that needs a Chinese business license and an ICP filing. A compliance-first look at what that means for your global AWS stack.
Does AWS work in China?
Yes — AWS runs in mainland China, but only through a separate, partner-operated partition you reach with a Chinese business license, a brand-new account and an ICP filing. "We're on AWS" does not carry over.
AWS China is two regions — Beijing, operated by Sinnet, and Ningxia, operated by NWCD — on a separate account AWS calls "distinct and separate from other Amazon Web Services global" accounts. To open an account AWS requires "a valid Chinese business license," your existing credentials "will not be able to access resources in the" China Regions, and to host a public site there you must complete an "ICP Recordal" or "ICP License." Keep serving China from global AWS instead and your users' data sits offshore — a cross-border transfer of personal information PIPL governs, on servers that cannot be ICP-filed. The table below is AWS's own wording and the rule each door triggers.
This is a risk map, not a verdict — which door fits turns on your entity, your data and who your users are. Our China team can map your exposure and the filing path with you →
What Amazon Web Services (AWS)'s documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| AWS China is a separate cloud, not a region of your existing one. In AWS’s own words its Chinese partners run the regions — the Beijing Region "operated by Sinnet" and the Ningxia Region "operated by NWCD." You must "create an Amazon Web Services (China) Account… distinct and separate from other Amazon Web Services global Accounts," and "customers with existing Amazon Web Services Inc. credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa." | Amazon Web Services in China & FAQs (amazonaws.cn), retrieved 2026-10-07 |
| AWS enforces the compliance door at signup. To register an AWS China account a company must give AWS "a valid Chinese business license issued by the Bureau of Industry and Commerce and valid contact information," and "in accordance with Chinese laws and regulations, your identity must be verified before you may access" the China Regions. A Chinese legal entity is a precondition of the account itself — not a later step. | Amazon Web Services in China — FAQs (amazonaws.cn), retrieved 2026-10-07 |
| Hosting a public site in AWS China requires an ICP filing bound to the operator. AWS: a non-commercial site needs an "ICP Recordal" and a commercial one an "ICP License," and "domains without ICP recordal or ICP license shall not provide Internet information service." The filing is made through the specific operator — "apply for ICP recordal through NWCD" for Ningxia, "through SINNET" for Beijing — i.e. the ICP regime under State Council Order 292 and MIIT Order 33. How ICP filing works → | Amazon Web Services in China — ICP (amazonaws.cn/en/support/icp) & FAQs, retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Where your data sits depends on which door you pick. AWS states data in the China Regions "remain[s] exclusively in the Regions unless moved to other locations by the customer" — in-country by design. Serve China from global AWS instead and (AWS publishes no mainland region outside this walled-off partition — inference) your users' personal information is stored outside the mainland: a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), and for a CIIO or large-volume handler the data must be stored in China (CSL Article 39 (formerly Article 37); PIPL Article 40). | Amazon Web Services in China (amazonaws.cn), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| And delivery from global AWS is the second half of the question. From a datacenter probe inside mainland China (Alibaba Cloud) on 2026-08-27, aws.amazon.com completed only 1 of 3 page loads, with a median time to first byte of about 1.1 seconds — an intermittent result from a machine-room line, which is a lower bound, not what a home or office visitor sees. Either way, reachability is the delivery half, not the legal half that decides whether you may use it. | 21YunBox — paired measurement from inside mainland China (datacenter probe and Beijing residential broadband) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
Whether AWS “works” in mainland China is a compliance question before it is a performance one. AWS does run inside the mainland — but only through a separate partition you reach with a Chinese entity, a brand-new account and an ICP filing; and a global AWS stack that serves China keeps your users’ data offshore. Those are the two doors, and AWS documents both in its own words.
AWS China at a glance
| What decides it | In AWS's own terms |
|---|---|
| Where it runs | Two mainland regions — Beijing (cn-north-1) operated by Sinnet, Ningxia (cn-northwest-1) operated by NWCD — a partition separate from global AWS. |
| Separate account | You must create an AWS (China) account “distinct and separate from other Amazon Web Services global Accounts”; existing credentials “will not be able to access resources in the Amazon Web Services China Regions, and vice versa.” |
| Entity required | Registering needs “a valid Chinese business license issued by the Bureau of Industry and Commerce.” |
| Serving the public | A domain “without ICP recordal or ICP license shall not provide Internet information service,” filed through Sinnet or NWCD (see the page above). |
| Your data on global AWS | Stays outside the mainland — a cross-border transfer of personal information PIPL governs, on infrastructure that cannot be ICP-filed. |
Door one — AWS China is a separate, partner-operated partition
AWS runs in mainland China, but not as a region of the account you already have. In AWS’s own words the China regions are operated by its Chinese partners — Beijing by Sinnet and Ningxia by NWCD — and you must “create an Amazon Web Services (China) Account… distinct and separate from other Amazon Web Services global Accounts.” Existing credentials “will not be able to access resources in the Amazon Web Services China Regions, and vice versa,” and to register one AWS requires “a valid Chinese business license issued by the Bureau of Industry and Commerce.”
Serving a public-facing site from inside the mainland then turns on an ICP filing. On its own ICP page (above), AWS states a domain “without ICP recordal or ICP license shall not provide Internet information service,” applied for “by SINNET or NWCD.” So “we’re already on AWS” does not carry into China: the in-country door is a Chinese entity, a separate account, and an ICP filing — the regime under State Council Order No. 292 and MIIT Order No. 33.
A moving target — AWS is retiring its in-country CloudFront
If your China plan leaned on Amazon CloudFront inside the partition, note AWS’s own end-of-support notice: it will “discontinue support for Amazon CloudFront in the Amazon Web Services China (Ningxia) region” on May 31, 2027, decommissioning its four in-country points of presence, and “no new customers will be accepted after September 30, 2026.” Lawful in-mainland delivery now has to be built on infrastructure that stays ICP-filed and durable — continuity is part of the compliance question, not just reachability.
Door two — global AWS keeps your China data offshore
Keep serving China from global AWS instead, and your users’ personal information sits outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer: the handler — you, not AWS — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — which an offshore AWS region cannot do, and an offshore edge cannot be ICP-filed.
This is a risk map, not a verdict: which door fits turns on your entity, your data and who your users are, and it is worth confirming with counsel.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on AWS. We add the piece AWS makes you arrange yourself: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing AWS origin — no rebuild, no second codebase, and no move off your global stack. Our China team maps which door fits, assesses your PIPL cross-border and data-residency exposure for your entity and data volumes, and stands up the in-country delivery and storage a compliant China presence requires.
Related reading:
