.jpg)
AWS China is a separate cloud from AWS Global. It runs two regions, Beijing (cn-north-1) operated by Sinnet and Ningxia (cn-northwest-1) operated by NWCD, and your global credentials do not work there. You sign up for a new AWS China account, and consolidated billing and cross-account IAM stop at that boundary.
Publishing content from either region requires an ICP filing, which only a legal entity registered in China can hold. Service coverage differs from AWS Global. Cross-border connection speed drops between 03:30 p.m. and 10:00 p.m. UTC, and the Great Firewall blocks registries your build pipeline likely depends on.
Viacheslav Kompaniets, MEV's Director of Infrastructure and Operations, walks through the seven lessons from a deployment his team ran.
In an age where the digital world knows no bounds, the allure of tapping into China's vast market potential beckons enterprises worldwide. The remarkable technological prowess of China presents an enticing prospect, yet it comes with a complex web of regulations and infrastructure intricacies that require a strategic approach for seamless integration.
In this article, Viacheslav Kompaniets, our Director of Infrastructure & Operations, unfolds the captivating journey of a company leveraging Amazon Web Services (AWS) to enter China's dynamic market. However, beneath the surface lay a mix of challenges and insights that pave the way for an expansion.
What Makes AWS China Different from AWS Global?
While integrating AWS into the growing Chinese market may seem straightforward, it was far from it. Several complexities created challenges to overcome.
Key considerations included the availability of required services within supported regions, the vital Internet Content Provider (ICP) registration, and the impact of connection speed—three critical factors that could make or break success.
The challenge of connection speed, primarily affecting external traffic, was a recurring theme. Despite initial confidence, thanks to requisite licenses and an established AWS account, a deeper analysis revealed the need for a strategic approach to overcome these complexities.
What Do You Need Before You Deploy on AWS China?
A few critical complexities arise while navigating China's digital landscape:
- Obtaining an ICP license
- AWS China vs. AWS Global differences
- Service availabilities
- Connection speed challenges
- Resource scarcity
- Tooling compatibility
- Content delivery
What is an ICP license and who can get one?
An ICP license is a Chinese government permit that lets you publish content from servers hosted in mainland China. Only a legal entity registered in China can hold one.
Creating a new AWS account in China differs significantly from its global counterpart. Qualifying as a legal entity or an individual with Chinese citizenship is a prerequisite for account registration. Additionally, obtaining an Internet Content Provider (ICP) license is mandatory for posting or uploading content. Acquiring an ICP license involves providing detailed ownership information, including domain names, IP addresses, site content, purposes, and a designated security contact person.
Only individuals or legal entities registered within China can obtain this license, which puts it out of reach for a foreign company without a local presence. Sinnet and NWCD provide ICP support at no extra charge, though you still pay whatever fees the government authority sets. AWS covers the filing procedure in its AWS China FAQ on ICP Recordal.
How does an AWS China account differ from a global account?
AWS China and AWS Global run as separate partitions with no shared account system. Your global credentials do not work in China.
AWS China covers two regions, each operated by a licensed local partner: Beijing (cn-north-1) operated by Beijing Sinnet Technology, and Ningxia (cn-northwest-1) operated by Ningxia Western Cloud Data Technology (NWCD). Anyone who wants resources in either region signs up for an AWS China account with credentials separate from any global AWS account. Sinnet and NWCD also act as the licensed providers who support and verify ICP Recordal and ICP License for customers in their region, as AWS documents on its China regions page.
The separation shows up in the console domain as well. AWS China runs at https://console.amazonaws.cn/, while the global console stays at https://console.aws.amazon.com/.
Certain functionalities, such as managing organizations, achieving consolidated billing, implementing IAM cross-account functionality, and replication, are not feasible between Global and China accounts.
Which AWS services are available in the China regions?
Service coverage differs between the two partitions, and a service present in both can behave differently. CloudFront in China does not support ACM certificates. Service availability may differ between regions. It's crucial to consider that even if a service is available in China, its functionality may differ from its global counterpart. For instance, CloudFront in China lacks support for ACM certificates and designated distribution.
As a result, document the intended use of every service you plan to run, then check it against the AWS China regional service list before you commit to an architecture. Pair that check with a scoped proof of concept, which is how our DevOps and cloud operations team validates a region before migration work starts.
Why is AWS China slow from outside the country?
Speed degrades for traffic crossing the border, worst between 03:30 p.m. and 10:00 p.m. UTC. Traffic inside China stays fast.
The sluggish connection speed primarily affects external traffic, while operations within China proceed without hindrance. This distinction is crucial because our product was tailored for users within this region, making them immune to this issue. However, this localized concern created complications for our developers and infrastructure engineers in the United States and Ukraine. The repercussions affected various facets, including infrastructure deployment, management, assembly, monitoring, and CI/CD processes.
Additionally, connection speed is notably contingent on the time of day, with the most challenging period spanning from 03:30 p.m. to 10:00 p.m. UTC.
As a result, we avoided deployment activities toward the end of the day.
Which build resources does the Great Firewall block?
The Great Firewall blocks Google Container Registry outright and makes parts of Docker Hub and public npm or Python registries unreachable from inside China.
Challenges extend beyond connection speed and stability, including the unavailability of specific resources, primarily due to limitations imposed by Internet service providers and the Great China Firewall. These hurdles include the unavailability of specific Docker Hub resources, inaccessibility of Google Container Registry, and difficulties accessing specific npm or Python repositories.
We made it work by judiciously selecting mirrors and assembling custom registries when needed.
Which DevOps tools break against the China partition?
Tools built against AWS Global endpoints often fail against amazonaws.cn. Check every provider and SDK in your stack against the China partition before you commit. Tools might not seamlessly align with the Chinese region. It's crucial to scrutinize the compatibility of tools and adapt them to the region's unique requirements.
Which CDN works best for AWS China deployments?
AliCDN gives wider coverage across East Asia than global CDN providers, which matters when your users sit outside mainland China. Due to the slow connection speed, embracing a Content Delivery Network (CDN) can significantly improve performance, primarily when operating beyond the country's borders.
AliCDN from AliCloud is a relatively large and well-known cloud provider in the Asian region. AliCDN has a more extensive server network in Eastern countries and provides better service than other cloud providers.
If you decide to leverage a Content Delivery Network, consider AliCDN as a provider.
How Do You Deploy a Project on AWS China Successfully?
Successfully navigating China's digital landscape requires a strategic approach:
1. Establish an AWS China account and secure an ICP license.
2. Recognize the distinctions between AWS Global and AWS China.
3. Thoroughly assess service availability and limitations.
4. Factor in additional time due to potentially sluggish connections.
5. Verify the availability of all requisite resources.
6. Ensure the compatibility and functionality of your tools within the Chinese region.
These strategies will prove invaluable in navigating the complexities behind the Great Firewall.
This article is for infrastructure and DevOps leads who have been asked to stand up a product inside mainland China and want to know what breaks before they commit to a plan.
Our infrastructure team ran this deployment with engineers in the United States and Ukraine building for users inside China.
AWS documents the account structure and the ICP requirement. What caught us out sat lower down: registry access during builds, and deploy windows that shift with the time of day. We wrote up what we ran into so the next team can plan around it.
.jpg)
