Does AWS WAF Work in China? ICP, Cross-Border Request Data & the Separate China Partition

Whether AWS WAF “works” in mainland China is a compliance question before it is a performance one — and for a web application firewall the compliance question has a particular shape, because a WAF exists to read the traffic it guards. AWS WAF does run inside the mainland, but only through AWS’s separate China partition, reached with a Chinese entity, a separate account and an ICP filing. Keep a non-China AWS WAF in front of a China-facing property instead, and the client IP addresses, headers and request bodies it inspects and logs are read from offshore — a cross-border movement of personal information, not just a routing detail. AWS states where its China service runs, and who operates it, in its own words.

AWS WAF in China at a glance

Door one — in-country AWS WAF lives in AWS’s separate China partition

AWS WAF does reach inside mainland China, but not from the account you already have. AWS offers the service — branded Amazon WAF in-country — in its two mainland Regions, and its own Region Table lists it as available in both Beijing and Ningxia. Those Regions are a partition apart from global AWS: as AWS puts it, the Beijing Region is operated by Beijing Sinnet Technology Co., Ltd. (“Sinnet”) and the Ningxia Region by Ningxia Western Cloud Data Technology Co., Ltd. (“NWCD”).

Reaching that partition means the same gate AWS sets for all of its China Regions. Customers “are required to sign up for a separate set of account credentials unique to Amazon Web Services China services,” and “[c]ustomers with existing Amazon Web Services Inc. credentials will not be able to access resources in the Amazon Web Services China Regions, and vice versa.” Registering one needs “a valid Chinese business license issued by the Bureau of Industry and Commerce.” And to serve the public, AWS’s own FAQ is explicit: a non-commercial site “must undertake filing procedures for a non-commercial website (“ICP Recordal”),” and a commercial one “must obtain a value-added telecommunications license for a commercial website (“ICP License”).” So “we’re already on AWS WAF” does not carry into China; the in-country door is a Chinese entity, a separate account and an ICP filing — the same two-door structure AWS sets out in full for its China Regions (see Does AWS work in China?).

Door two — a firewall reads the traffic, so running it offshore crosses the border

Here is the part specific to a WAF. A web application firewall is not a passive pipe; its whole job is to inspect what passes through it. In AWS’s own description, Amazon WAF lets you “filter any part of the web request, such as IP addresses, HTTP headers, HTTP body, or URI strings,” and it offers “comprehensive logging by capturing each inspected web request’s full header data.” Those client IP addresses, headers and request bodies, pulled from people in China, are personal information.

So where you place the firewall is itself a data-handling decision. Keep a non-China AWS WAF — in Tokyo, Hong Kong, Oregon, anywhere outside the mainland — in front of a China-facing site or API, and every request it screens is carried out of the country to be read, and often logged, offshore. Under China’s Personal Information Protection Law that is a cross-border transfer, and the duty falls on you as the handler, not on AWS as the processor: notice, a separate consent for the overseas transfer, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–40). Above certain thresholds it may also require China’s data-export security assessment (数据出境安全评估) before anything leaves.

Residency is the other half. If your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization clause was renumbered by the 2025 amendment in force since January 1, 2026, its substance unchanged) requires personal information generated in China to be stored in China (see also PIPL Article 40) — a duty a WAF logging full request headers to an offshore Region cannot satisfy. None of this turns on how fast the firewall is; it turns on where it reads and keeps the traffic. For that reason this page publishes no China latency figure for AWS WAF: speed is not the axis for a decision that turns on residency and cross-border transfer.

This is a risk map, not a verdict that AWS WAF is “blocked” or “illegal.” Which of these obligations bite depends on your entity, the personal data your traffic carries, your role under Chinese law and who your users are — worth settling with counsel before your protection depends on it.

Why pointing the WAF at a nearer Region isn’t the fix

The reflex is to move the firewall to the closest AWS Region — Hong Kong, say — and call the distance problem solved. But every global AWS WAF Region sits outside mainland China, so a nearer one changes the latency, not the law: the request data is still inspected and logged across the border, and the transfer is unchanged. The only placement that keeps a China user’s request data in the country is an in-country one — AWS WAF inside the China partition (ICP-filed, the data held in the mainland under Sinnet or NWCD), or an equivalent in-country edge-security layer. Which traffic must be inspected in-country, and which may be screened elsewhere, is a legal question before it is a networking one.

The lawful path — map, localize, deliver

There is a compliant way to keep a web application firewall in front of a China-facing property, and it has a shape.

First, map. Our China compliance team charts where your WAF actually inspects and logs traffic today, and the exposure that follows: whether the client IP addresses, headers and request bodies it reads from China users leave the mainland, which PIPL transfer and consent duties attach, whether a data-export security assessment or an in-country storage duty bites for your role and volumes, and whether the protected property owes an ICP filing. We build the technical picture; the legal conclusions are settled with your counsel.

Then localize. Where request inspection has to happen on a China footing, we move it onto a lawful in-country option — AWS’s own China partition (Beijing/Ningxia, ICP-filed, with the data held in-country under Sinnet or NWCD) or an equivalent in-country edge-security layer — so the firewall protecting your China users stops reading and storing their request data offshore by default, while you keep AWS WAF for the markets where it already serves you.

Then deliver. The China-facing site or API that sits behind the firewall is itself a public service in the mainland, so it carries an ICP-filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of the origin you already run, with no rebuild and no re-platform. The result is a China-facing property whose protection and delivery both run legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind: what we never do — and what no one lawfully can — is hand you a way around China’s data-export rules or around any network restriction. We localize what must stay in-country, deliver in-country, and never move personal information out of China by stealth.

Get a compliance assessment →

Related reading:

• Does AWS work in China? ICP, data residency and the two doors
• How to get an ICP filing for China
• Cross-border data transfers under PIPL
• China’s Cybersecurity Law (data localization, Article 39)

RELATED TECHNOLOGIES

1Password

1Password

Auth0

Auth0

Bitwarden

Bitwarden

Citrix

Citrix

Cloudflare Turnstile

Cloudflare Turnstile

CrowdStrike

CrowdStrike

DataDome

DataDome

Google Authenticator App

Google Authenticator App

hCaptcha

hCaptcha

Dropbox Sign (Formerly Hellosign)

Dropbox Sign (Formerly Hellosign)

Microsoft Authenticator App

Microsoft Authenticator App

Microsoft Defender

Microsoft Defender

Microsoft Intune

Microsoft Intune

Okta

Okta

OneLogin

OneLogin

OneTrust

OneTrust

ReCaptcha

ReCaptcha

Securiti

Securiti

Snyk

Snyk

Zscaler

Zscaler