Amazon Identity and Access Management

Beijing Region

Ningxia Region

Users and credentials – In the Beijing and Ningxia Regions, there is no concept of the "root user" or "account user" credentials. All users are IAM users, including the user who created the account. Administrative IAM users might have permissions to complete tasks that require root user credentials. If they don't, you must contact Support to complete those tasks.

Forgot password – If an IAM user (including the administrator user) in the Beijing and Ningxia Regions forgets their password, they can reset the password from the Amazon Web Services Management Console. Amazon will send a password reset link to the email address that is associated with the Amazon account. Administrators cannot use a policy to deny access to this feature because the requestor is not signed in to Amazon. However, each request is stored as a CloudTrail entry. For more information, see IAM Credentials.

No hardware or SMS MFA – The Beijing and Ningxia Regions do not support using hardware or SMS multi-factor authentication (MFA) for IAM users. The Regions do support using virtual MFA. For information about using virtual MFA, see Enabling a Virtual Multi-factor Authentication (MFA) Device.

Web identity federation – Some web identity providers, such as social media platforms, might not be available in the Beijing and Ningxia Regions.

IAM control plane – There is one IAM control plane for all China Regions, which is located in the China (Beijing) Region. Each Amazon Web Services Region has a completely independent instance of the IAM data plane. For more information, see Resilience in Amazon Identity and Access Management.

Amazon API Signature Version – Services available in the Beijing and Ningxia Regions support only signature version 4 signing.

Policy names – IAM policy names can contain only the following Unicode characters: horizontal tab (x09), linefeed (x0A), carriage return (x0D), and characters in the range x20 to xFF. In practice, this means that you can't use Chinese characters in policy names.

Service principals in policies – In IAM policies where the principal is a service, the service principal name can include the following formats, with "service" replaced by the name of the service:

service.amazonaws.com

service.amazonaws.com.cn

For more information, see Creating a Role to Delegate Permissions to an Amazon Service and Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances.

SSH public keys – SSH public keys are used only in conjunction with CodeCommit, which is currently not available in the Beijing and Ningxia Regions.

In the Beijing Region, the Amazon Resource Name (ARN) syntax includes the aws-cn partition for resources in the Region. For example: arn:aws-cn:iam::123456789012:user/division_abc/subdivision_xyz/Zhang.

In the Ningxia Region, the Amazon Resource Name (ARN) syntax includes the aws-cn partition for resources in the Region. For example: arn:aws-cn:iam::123456789012:user/division_abc/subdivision_xyz/Wang.

Switching roles – In the Beijing Region and Ningxia Region, after you switch to a role in the Amazon Web Services Management Console, you cannot switch back to your original credentials. Instead, you must sign out and then sign in again using the desired credentials.

Only some Amazon services support service-linked roles in the Beijing and Ningxia Regions. For information about which services support using service-linked roles, see Amazon services that work with IAM and look for the services that have Yes in the Service-Linked Role column. To learn whether the service supports service-linked roles in a specific region, choose the Yes link to view the service-linked role documentation for that service.

Access Analyzer – The Beijing and Ningxia Regions do not support the creation of unused access analyzers. The Beijing and Ningxia Regions do not support the creation of external access analyzers with an organization as the zone of trust. The Beijing and Ningxia Regions do support creation of an analyzer with the Amazon Web Services account as the zone of trust. For more information, see Enabling Access Analyzer.

Last accessed data – Data about when an IAM identity (user, group, or role) last attempted to access an Amazon service through permissions granted by an IAM policy is not available. For more information, see Service Last Accessed Data.

Role last used – Information about when a role was last used is not available. For more information, see View Role Access.

Custom policy checks – Custom policy checks are not supported in the Beijing and Ningxia Regions. To learn more, see IAM Access Analyzer custom policy checks in the IAM User Guide.

Policy generation – Policy generation is not supported in the Beijing and Ningxia Regions. To learn more, see Generate policies based on access activity in the IAM User Guide.

IAM Roles Anywhere – The Beijing and Ningxia Regions do not support the creation of trust anchors with Amazon Private Certificate Authority. The Beijing and Ningxia Regions do support the creation of a trust anchor with your own certificate authority. To learn more, see Creating a trust anchor and profile in the IAM Roles Anywhere User Guide.

IAM User Guide

IAM API Reference

Accounts and credentials for other Amazon Regions will not work for services operating in the Beijing and Ningxia Regions.

Accounts and credentials for the Beijing and Ningxia Regions will not work for other Amazon Regions.

For more information, see Signup, Accounts, and Credentials.

In the Beijing Region, there are three Availability Zones.

In the Ningxia Region, there are three Availability Zones.

Amazon Identity and Access Management (IAM)

EC2-Classic Platform

Free Usage Tier