Does Amazon S3 Work in China? ICP, Data Residency & the Two Doors
Global S3 keeps the objects you store for China users in offshore AWS Regions — a PIPL cross-border transfer and a data-residency exposure — while S3 in-country runs only in the separate, Sinnet/NWCD-operated AWS China Regions, with a China account, a Chinese entity and an ICP filing. A compliance-first look at the two doors.
Does Amazon S3 work in China?
Whether you can use Amazon S3 in China is a data-residency question before it is a performance one. S3 holds your objects — files, uploads, documents, images, often personal information about your users — and China's law responds to where those objects physically sit, not to how fast they download.
S3 does run inside the mainland, but only in a walled-off partition: by AWS's own China page, "Beijing Sinnet Technology Co., Ltd. (Sinnet) operates and provides cloud services in Amazon Web Services China (Beijing) Region" and "Ningxia Western Cloud Data Technology Co., Ltd. (NWCD) operates and provides cloud services in Amazon Web Services China (Ningxia) Region" — a separate partition reached with a distinct China AWS account, a Chinese business license, and, for public workloads, an ICP filing. Your existing buckets do not live there: global S3 stores every bucket in an offshore AWS Region, and the global partition has no mainland-China Region. So the objects you keep for China users are a cross-border transfer PIPL governs. The table below is AWS's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your S3 exposure with you →
What AWS S3's own documentation says about China
| Fact | Primary source |
|---|---|
| In AWS's own words, its China Regions are a separate partition operated by Chinese companies. AWS's China page states that "Beijing Sinnet Technology Co., Ltd. (Sinnet) operates and provides cloud services in Amazon Web Services China (Beijing) Region," and that "Ningxia Western Cloud Data Technology Co., Ltd. (NWCD) operates and provides cloud services in Amazon Web Services China (Ningxia) Region." Amazon S3 is one of the foundational services offered in both Regions — but reaching them means you "create an Amazon Web Services (China) Account, a set of credentials that are distinct and separate from other Amazon Web Services global Accounts," and "Only customers with an Amazon Web Services (China) Account will be able to use resources in China regions." | Amazon Web Services in China (amazonaws.cn), retrieved 2026-10-08 |
Global S3 cannot reach the China partition. Because the China Regions are a separate partition on a separate account (above), a bucket on your global S3 lives in whichever global AWS Region you chose — the global S3 Region list runs from the United States through EMEA and Asia Pacific, including Hong Kong, Tokyo and Singapore, with no mainland-China Region; cn-north-1 (Beijing) and cn-northwest-1 (Ningxia) sit in the isolated China partition. S3 Cross-Region Replication copies objects only between global Regions you select, so enabling it spreads your data across more offshore Regions — it does not place it on Chinese soil. | Amazon Web Services in China (amazonaws.cn); AWS Regions and endpoints for Amazon S3, retrieved 2026-10-08 |
| Hosting a public-facing workload in AWS China requires an ICP filing. On the same page, AWS states the rule under Chinese law: "No one may engage in the provision of internet information services without having carried out record-filing procedures or obtained permission." A non-commercial site needs an "ICP Recordal" and a commercial one an "ICP License," filed through the Region's operator — Sinnet for Beijing, NWCD for Ningxia — the ICP regime under State Council Order No. 292 and MIIT Order No. 33. How ICP filing works → | Amazon Web Services in China (amazonaws.cn), retrieved 2026-10-08; State Council Order No. 292; MIIT Order No. 33 |
| Objects holding China users' personal data that sit in an offshore S3 Region leave the country. PIPL governs that cross-border transfer: the personal-information handler (you, AWS's customer — not AWS) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The exposure scales with volume and role: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from all three. | PIPL Chapter III, Articles 38–43; CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, China-collected personal information must stay on the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). An offshore S3 Region cannot meet that, so keeping your China users' objects on Chinese soil means running S3 in the Sinnet/NWCD China partition — and serving anything public-facing from there brings an ICP filing into the picture. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Amazon S3 is not how quickly an object downloads — it is where that object is allowed to sit. S3 does run inside the mainland, but only in a separate AWS partition reached through a Chinese entity, a distinct China account and, for public workloads, an ICP filing; keep your buckets on global S3 instead and the objects you hold for China users stay offshore. Those are the two doors, and AWS documents both in its own words.
Amazon S3 in China at a glance
| What decides it | In AWS's own terms |
|---|---|
| Where your objects live | Global S3 stores each bucket in the AWS Region you choose. AWS's S3 Region list runs from the United States through EMEA and Asia Pacific — including Hong Kong, Tokyo and Singapore — but carries no mainland-China Region; those belong to a separate China partition. |
| Replication stays in the global partition | S3 Cross-Region Replication copies objects between the AWS Regions you select — all offshore. It does not replicate into the isolated China partition, so turning it on does not move objects onto Chinese soil. |
| S3 in-country does exist | S3 runs in the Beijing Region “operated by Sinnet” and the Ningxia Region “operated by NWCD” — a distinct AWS China partition, not a region of your global account. |
| Separate account & entity | Reaching that partition needs an AWS (China) account “distinct and separate from other Amazon Web Services global Accounts” and a Chinese business license; global credentials do not cross into it, and a public-facing workload needs an ICP filing. |
| Your objects on global S3 | Personal information inside objects you store for China users stays outside the mainland — a cross-border transfer PIPL governs, on infrastructure that cannot be ICP-filed. |
Door one — S3 in China is a separate, Sinnet/NWCD-operated partition
S3 does run inside mainland China — but not as a region of the account you already hold. On its China page, AWS states that “Beijing Sinnet Technology Co., Ltd. (Sinnet) operates and provides cloud services in Amazon Web Services China (Beijing) Region,” and that “Ningxia Western Cloud Data Technology Co., Ltd. (NWCD) operates and provides cloud services in Amazon Web Services China (Ningxia) Region.” Those Regions are a partition walled off from global AWS: to use anything in them — S3 among them — you must “create an Amazon Web Services (China) Account, a set of credentials that are distinct and separate from other Amazon Web Services global Accounts,” and “Only customers with an Amazon Web Services (China) Account will be able to use resources in China regions.” Registering one is tied to a Chinese business license; your global credentials and your existing buckets do not cross into it.
Serving a public-facing workload from inside the mainland then turns on an ICP filing. AWS puts the rule plainly on the same page: “No one may engage in the provision of internet information services without having carried out record-filing procedures or obtained permission,” with Sinnet and NWCD acting as the licensed providers that support ICP Recordal (for a non-commercial site) and ICP License (for a commercial one) in their Regions. So “we already keep everything in S3” does not carry into China: the in-country door is a Chinese entity, a separate China account, and — for anything public-facing — an ICP filing under State Council Order No. 292 and MIIT Order No. 33. It is a genuine door, but a distinct build, not a toggle on the account you have.
Door two — global S3 keeps your China objects offshore
Keep your buckets on global S3 and they live in whichever AWS Region you chose. S3’s Region list stretches from the United States through EMEA and Asia Pacific — Hong Kong, Tokyo, Singapore — yet carries no cn-north-1 or cn-northwest-1, because those sit in the separate China partition. S3 Cross-Region Replication copies objects between the Regions you pick, but only Regions in the global partition; switching it on spreads your objects across more offshore Regions — it does not place them on Chinese soil.
And the personal information inside those objects sits in that offshore Region. Under China’s Personal Information Protection Law that is a cross-border transfer: the handler — you, AWS’s customer, not AWS — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — which an offshore S3 Region cannot do, and an offshore endpoint cannot be ICP-filed.
This is a risk map, not a verdict: which door fits turns on your entity, your objects and who your users are, and it is worth confirming with counsel.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on S3 — global or the Sinnet/NWCD China Regions. We add the piece AWS leaves you to arrange yourself: compliant, ICP-filed delivery from inside the mainland, set in front of your existing origin — no rebuild, no second codebase, and no forced move between partitions. Our China team maps which door fits, assesses your PIPL cross-border and data-residency exposure for your entity and object volumes, and stands up the in-country delivery and storage a compliant China presence requires.
Related reading:
