How to Host a Website in China Using Alibaba Cloud (Step-by-Step)

I’ve spent the better part of a decade rescuing foreign companies’ cloud architectures in Mainland China. If there’s one constant in this job, it’s watching engineering teams attempt to simply “lift and shift” their standard AWS, GCP, or Azure blueprints across the border.

It never works. Millions of dollars in potential revenue are lost every year to this exact mistake.

Between the stringent regulatory environment (ICP licensing), the deeply intrusive network topology of the Great Firewall (GFW), and a fragmented domestic ISP landscape that actively penalizes bad routing, deploying in China requires an entirely different engineering playbook.

If you want low-latency access and reliable uptime for Chinese consumers, deploying infrastructure natively on Alibaba Cloud isn’t just a recommendation. It is non-negotiable.

Here is the playbook I use. We’re going to cover the actual IaC configurations, the cross-border networking traps that will break your database, and the mandatory state bureaucracy you have to clear. No fluff. Just what actually works in production based on hundreds of deployments.

Stop Burning Engineering Hours on Trial and Error

Building China-ready infrastructure from scratch can take months of compliance delays, unexpected network throttling, and CI/CD rewrites. If you need to deploy quickly, securely, and legally, our team of certified Alibaba Cloud architects specializes in building China-Optimized Infrastructure.

👉 [Book an architecture review today] to see how we can map out your deployment.

1. The “Lift and Shift” Fallacy

Let’s get the most common anti-pattern out of the way: you cannot just copy-paste your AWS US-East Terraform modules, change the region to cn-beijing, and call it a day.

Usually, teams try to outsmart the system. They don’t want to deal with Chinese business licenses, so they spin up infrastructure in Hong Kong. It looks great on paper. Hong Kong is geographically close, right?

Then, during a peak sales event like Singles’ Day (11.11), the Great Firewall’s Deep Packet Inspection (DPI) decides it doesn’t like the sudden surge in encrypted traffic patterns crossing the border. Latency spikes to 400ms. TCP connections randomly reset. The app becomes entirely unusable, and your engineering team spends a frantic 48 hours chasing “network ghosts” that are actually state-level algorithmic throttling.

Let’s look at the numbers. I pulled these from a 30-day monitoring window for a client. We benchmarked API response times for a user on China Telecom in Beijing accessing various global regions.

Notice how the 99th percentile (p99) latency absolutely explodes once traffic crosses the mainland border:

The ISP Fragmentation Problem

Here is something AWS engineers rarely have to think about: domestic ISP peering. China’s internet is heavily partitioned. China Telecom dominates the south. China Unicom dominates the north. China Mobile handles the cellular traffic.

If you host a server on a cheap, single-line data center in Beijing (Unicom territory), a user in Shenzhen (Telecom territory) has to cross massive peering bottlenecks. It’s like routing traffic through a dial-up modem.

The Consultant’s Verdict: If you want your application to actually function for users in Mainland China, you have to deploy inside Mainland China. And if you are building a serious production environment targeting 99.99% uptime, that means using Alibaba Cloud. Alibaba pays for the deepest BGP peering with all three state-owned ISPs, routing traffic dynamically to avoid these localized peering wars. Full stop.

2. The ICP License: Swallow the Pill

You’re probably dreading the ICP (Internet Content Provider) license process. You should be. It’s a bureaucratic headache. But without it, Alibaba’s automated filters will null-route your port 80/443 traffic at the ingress layer within hours of you binding a domain. Your load balancers will just return dead air.

Here is the practical advice that legal teams constantly overcomplicate.

The Decision Logic: Unless you are directly processing RMB payments natively on the mainland site (acting as a storefront) or hosting public, unmoderated user-generated content (like a forum or social network), you do not need the brutally difficult “Commercial” ICP license (ICP Zheng).

Most foreign SaaS companies, B2B platforms, and standard corporate sites run perfectly fine on a standard ICP Filing (Bei’an). It’s essentially a registration with the Ministry of Industry and Information Technology (MIIT) saying, “Here is who we are, and here is what this server does.”

Pro-Tip: Decouple Your Payment Gateway

If you are an e-commerce site or a SaaS with a billing portal, keep your core application and database on the mainland server. But route the actual checkout and credit card processing to a .com subdomain hosted in Hong Kong or Tokyo using Stripe, Adyen, or a global payment processor. In my experience, this legally bypasses the need for a commercial ICP and saves you 6 to 9 months of legal nightmares. The Chinese user gets a fast app experience, and the momentary redirect for payment processing is acceptable.

Stuck in the Compliance Maze? We Can Help.

Navigating the MIIT and PSB (Public Security Bureau) filing requirements without a local Chinese entity or bilingual IT staff is the number one reason foreign deployments fail before they even start. You don’t have to figure it out alone. Our local compliance liaisons handle the paperwork, the face-recognition verifications, and the bureaucracy so your engineers can focus on code.

👉 [Speak to our China Compliance Experts]

3. Cost Realities: The True Price of BGP Bandwidth

In AWS US-East, bandwidth is practically an afterthought. You pay pennies per gigabyte and move on. In Alibaba China, it will be your primary cost vector.

Compute (ECS) and storage (OSS, ESSD) are incredibly competitive. But BGP public bandwidth is notoriously expensive due to the state-owned ISP monopoly. You aren’t just paying for data transfer; you are paying for premium routing across the Telecom/Unicom divide.

Below is an example cost benchmark from a recent client audit. We looked at a standard production microservice node (Equivalent: 2 vCPU, 8GB RAM, 50GB NVMe SSD) running 24/7, pushing 2TB of outbound web traffic per month:

The “PayByTraffic” vs “PayByBandwidth” Trap

If you scale to handle a peak load of 10,000 QPS with an average payload of 50KB, you need roughly 4 Gbps of outbound bandwidth.

In the US, scaling an ALB to push 4 Gbps is standard. In China, paying for a fixed 4 Gbps public IP line (PayByBandwidth) can cost upwards of $15,000 to $20,000 a month. Do not do this.

The Architect’s Fix: Always configure your SLB/ALB Elastic IPs to bill by traffic (PayByTraffic). Furthermore, never serve static assets (React bundles, images, CSS) directly from your ECS instances or Kubernetes pods.

Use Alibaba Cloud’s Object Storage Service (OSS) combined with DCDN (Dynamic Route for CDN). Shifting 80% of your static load to the CDN drops your networking bill by nearly 70%, because CDN egress is a fraction of the cost of raw BGP egress.

Terraform Snippet: Offloading Bandwidth via OSS and DCDN

Terraform

# Create an OSS Bucket for Static Assets
resource "alicloud_oss_bucket" "static_assets" {
  bucket = "company-cn-static-assets"
  acl    = "public-read"
}

# Bind DCDN to the OSS Bucket to slash bandwidth costs
resource "alicloud_dcdn_domain" "cdn" {
  domain_name = "static.example.cn"
  sources {
    content  = alicloud_oss_bucket.static_assets.extranet_endpoint
    type     = "oss"
    priority = "20"
    port     = 80
  }
}

4. Debugging the “Leaky” Frontend

I once watched a multi-million dollar SaaS product launch completely tank. The marketing was there, the sales team was ready. The engineering team provisioned the fastest Enterprise NVMe SSDs capable of 100,000 IOPS. They set up a pristine, multi-AZ Kubernetes cluster in Beijing. They hit launch.

And the site took 30 seconds to load in Shanghai.

Why? Because the frontend was “leaking.”

The code was trying to fetch Google Fonts, a Facebook tracking pixel, and a Google reCAPTCHA script. The GFW doesn’t just return a clean 403 Forbidden error for these endpoints. It blackholes them via DNS poisoning. The browser thread hangs, sitting there waiting for a TCP handshake that will literally never arrive, until the browser’s internal timeout finally hits at the 30-second mark. Only then does the rest of your DOM render.

Real-World UX Benchmark (React SPA loaded from Shanghai):

Open your Chrome DevTools. Go to the Network tab. If you see any red lines timing out to domains like fonts.googleapis.com, ajax.cloudflare.com, or googletagmanager.com, your Chinese users are experiencing a broken site.

Practical Recommendation: Audit your code. Strip out every single western dependency. Use domestic equivalents (e.g., Baidu Analytics instead of Google Analytics, Geetest instead of reCAPTCHA).

If you can’t easily refactor a legacy frontend codebase, inject an Nginx reverse proxy at the ingress layer to rewrite these blocked domains on the fly. It’s a dirty fix, but it works in a pinch:

Nginx

server {
    listen 80;
    server_name www.example.cn;

    location / {
        proxy_pass http://upstream_app;
        proxy_set_header Accept-Encoding ""; # Required for sub_filter to work
        
        # Rewrite blocked Google Fonts to a domestic mirror
        sub_filter 'fonts.googleapis.com' 'fonts.font.im';
        sub_filter 'ajax.googleapis.com' 'cdn.bootcdn.net/ajax/libs';
        
        # Strip out Google Analytics entirely so it doesn't hang
        sub_filter 'https://www.google-analytics.com/analytics.js' '';
        sub_filter_once off;
    }
}

5. Cross-Border Data Sync: The 3 AM Pager Nightmare

If your application requires data to sync between a global region (e.g., AWS US-East) and a Mainland region, cross-border replication over the public internet is a ticking time bomb.

I’ve seen startups try to save a few hundred bucks a month by setting up a cheap IPSec VPN between AWS and Alibaba over the public internet. It works fine for a week. Then, usually around 3 AM on a Sunday, the GFW’s heuristic models flag the persistent, highly encrypted tunnel as suspicious. They don’t block it—they just randomly drop packets and inject TCP RSTs.

Your database state corrupts. Split-brain occurs in your clustering. You get paged. You spend your weekend fixing replication lag.

Bite the bullet and pay for Alibaba’s Cloud Enterprise Network (CEN). It acts as a private, cross-border SD-WAN over Alibaba’s dedicated fiber backbone. Because it’s an internal corporate leased line, it completely bypasses the GFW for internal VPC-to-VPC traffic.

Failure Case Benchmark: 5GB Database Dump Transfer (Beijing to AWS Virginia)

• Over Public Internet (IPSec VPN): Fails 4 out of 5 times due to connection resets. Effective throughput fluctuates between 500 Kbps and 4 Mbps. Averages 2.5 hours to transfer successfully—if it doesn’t fail entirely.
• Over Alibaba CEN (100 Mbps Dedicated Cross-Border Link): Sustains 95-98 Mbps with sub-2ms jitter. Completes reliably in ~7 minutes with 0% packet loss.

Terraform Snippet: Provisioning a CEN Instance

Terraform

# Create Cloud Enterprise Network (CEN)
resource "alicloud_cen_instance" "cross_border_sync" {
  cen_instance_name = "china-global-backbone"
  description       = "Bypassing GFW for DB Replication"
}

# Attach Beijing VPC to CEN
resource "alicloud_cen_instance_attachment" "bj_vpc_attach" {
  instance_id              = alicloud_cen_instance.cross_border_sync.id
  child_instance_id        = alicloud_vpc.prod_vpc.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-beijing"
}

(Note: To complete the link to AWS, you will also need to provision an Alibaba Cloud Transit Router, a cross-border Bandwidth Package, and an IPsec connection terminating at your AWS Transit Gateway).

Need Help Implementing Complex Cloud Routing?

Misconfigured cross-border tunnels lead to corrupted databases and silent API failures. You don’t want to experiment with BGP routing across international borders in production. Let our DevOps team design, provision, and test your cross-border SD-WAN using production-grade Terraform.

👉 [Get a Custom Networking Architecture Plan]

6. Localizing Your CI/CD and Observability

Here is a reality check that catches a lot of platform engineers off guard: your deployment pipelines will break.

The Artifact Supply Chain

Pulling Docker images from Docker Hub or ghcr.io into a Beijing Kubernetes cluster is like trying to suck a golf ball through a garden hose. Pull times frequently exceed 10 minutes, or they just time out entirely with ErrImagePull.

You must localize your artifact supply chain. Set up an Alibaba Cloud Container Registry (ACR) Enterprise instance inside your Beijing VPC.

Your CI pipeline should build the image globally, then push it to the mainland registry.

Bash

# 1. Log in to your mainland ACR Enterprise instance
docker login --username=your_aliyun_id registry.cn-beijing.aliyuncs.com

# 2. Tag your locally built image for the Alibaba Cloud registry
docker tag my-frontend-app:v1.2.0 registry.cn-beijing.aliyuncs.com/my_company/my-frontend-app:v1.2.0

# 3. Push the image to the Beijing region
docker push registry.cn-beijing.aliyuncs.com/my_company/my-frontend-app:v1.2.0

Also, if you rely on GitHub Actions for deployment, understand that GitHub’s runners are outside China. Trying to run kubectl apply from a GitHub Action runner into a private Alibaba ACK cluster requires exposing your API server to the public internet. Don’t do that. Instead, run a self-hosted GitHub runner or a GitLab runner inside your Alibaba VPC.

Observability in a Walled Garden

Are you a heavy Datadog or New Relic user? Get ready for pain.

Datadog agents installed on your Alibaba ECS instances have to send their telemetry data back to Datadog’s ingest servers in the US or Europe. The GFW routinely throttles this traffic. What happens next? The Datadog agent’s local buffer fills up, it starts consuming massive amounts of CPU and RAM on your host machine to maintain state, and eventually, your application node crashes because the monitoring tool OOM’d it. It’s ironic and infuriating.

The Fix: You have two choices. Either deploy a Prometheus/Grafana stack entirely within your mainland VPC, or use Alibaba’s native tools. Alibaba’s Log Service (SLS) and CloudMonitor are actually incredibly robust. SLS is essentially a clone of Splunk/Elasticsearch, and it works flawlessly within the ecosystem without border latency issues.

7. The DevOps Guide: Deploying on Alibaba Cloud

To successfully host a production application in China, “ClickOps” in the console is a recipe for disaster. The Alibaba console is powerful, but translation quirks between the Chinese and English UI can lead to severe misconfigurations. You need reproducible, version-controlled infrastructure tuned specifically for Chinese network characteristics.

Alibaba Cloud actually maintains an excellent Terraform provider. Use it.

Infrastructure as Code: Networking and Compute

Because BGP bandwidth is a premium, always configure your ECS instances and Load Balancers to use Elastic IPs (EIPs) billed by traffic (PayByTraffic), rather than fixed bandwidth (PayByBandwidth), unless your baseline utilization is consistently pinned above 70%.

Terraform

provider "alicloud" {
  region = "cn-beijing"
}

# Network Layer
resource "alicloud_vpc" "prod_vpc" {
  vpc_name   = "production-beijing-vpc"
  cidr_block = "10.0.0.0/16"
}

resource "alicloud_vswitch" "web_vswitch" {
  vpc_id       = alicloud_vpc.prod_vpc.id
  cidr_block   = "10.0.1.0/24"
  zone_id      = "cn-beijing-h" # Always pin to specific AZs for stability
}

# Compute Layer (ECS with Aliyun Linux 3)
resource "alicloud_instance" "web_server" {
  availability_zone          = "cn-beijing-h"
  instance_type              = "ecs.g7.large" # 7th Gen Enterprise
  system_disk_category       = "cloud_essd"   
  system_disk_performance_level = "PL1" # PL1 offers up to 50k IOPS
  image_id                   = "aliyun_3_x64_20G_alibase_20230725.vhd"
  vswitch_id                 = alicloud_vswitch.web_vswitch.id
  internet_max_bandwidth_out = 100 # Burst up to 100Mbps
  internet_charge_type       = "PayByTraffic" 
}

Orchestration: Alibaba Cloud Kubernetes (ACK)

When deploying on ACK, exposing your application requires an Alibaba Cloud Server Load Balancer (SLB/ALB). You can configure this directly via Kubernetes service annotations.

Note that Application Load Balancers (ALB) in China can scale up to 1,000,000 QPS natively, which is vital for flash-sale events. But more importantly, you must attach a Web Application Firewall (WAF). The internet in China is highly adversarial.

YAML

apiVersion: v1
kind: Service
metadata:
  name: frontend-slb-service
  annotations:
    # Provisions a public-facing SLB instance billed by traffic
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-network-type: "internet"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-charge-type: "paybytraffic"
    # Mandatory: Attach to Web Application Firewall (WAF) to mitigate mainland botnets
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-waf-id: "waf-cn-beijing-xxx"
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 8080
    protocol: TCP
  selector:
    app: frontend

Day-2 Operations: Automating CDN Cache

When deploying a new frontend build, you must invalidate the mainland CDN cache so users immediately get the newest version. Hardcode this Aliyun CLI command into your pipeline. Don’t rely on TTLs.

Bash

# Clear the cache for the entire static assets directory via CLI
aliyun cdn RefreshObjectCaches \
  --ObjectPath "https://www.example.cn/static/" \
  --ObjectType Directory

8. Data Localization and PIPL Compliance

Let’s talk about the database layer.

If you are collecting data on Chinese citizens (names, phone numbers, addresses, behavioral data), you are subject to the Personal Information Protection Law (PIPL).

Do not stream this data back to your global database in AWS US-East. You must store PII domestically. Attempting to export large datasets of domestic user data without a formal security assessment from the Cyberspace Administration of China (CAC) is illegal and will result in massive fines or the shuttering of your service.

The Architecture: We generally recommend an active-active split-brain architecture.

Deploy an instance of your application in Alibaba Cloud connected to an Alibaba PolarDB instance (their proprietary, highly scalable MySQL/PostgreSQL equivalent). Keep all Chinese user data, transaction histories, and identity management within that PolarDB instance.

Use the CEN cross-border link only to sync anonymized metadata, aggregated analytics, or global product catalogs that do not contain PII.

9. When NOT to Use Full Infrastructure in China

Let me be brutally honest as an architect whose literal job is to build these environments: sometimes the best architectural decision is not to build it.

Do not deploy full infrastructure in Mainland China if:

1. Your China ARR is less than $100k: The overhead of ICP compliance, maintaining a localized CI/CD pipeline, and paying for specialized cloud engineering will destroy your profit margins.
2. You don’t have a legal Chinese entity (WFOE/JV): While workarounds exist for simple static marketing sites, running a SaaS business with domestic data collection requires a local legal presence to sign the cloud contracts and comply with PIPL.
3. You host highly sensitive political or unmoderated user-generated content: The moderation requirements (Content Security Management) are immense and pose severe legal liabilities to your company officers.

The Alternative: If you fall into these categories, host your application in Hong Kong, Tokyo, or Seoul. Then, use a specialized China CDN (like Alibaba DCDN or Cloudflare’s China Network) to accelerate traffic across the border.

It won’t be perfect. Your p99 latency will still jitter during major political events or holidays, but it entirely prevents the compliance nightmare.

10. Production Best Practices

If you are committed to the mainland deployment, I enforce these non-negotiable architectural rules with my teams:

1. Mandatory Anti-DDoS and WAF

The Chinese internet ecosystem is highly adversarial. Baseline DDoS attacks of 10 to 50 Gbps are daily occurrences, often just from automated botnets scanning for vulnerabilities. Running unprotected EIPs isn’t brave; it’s negligent. If Alibaba detects a massive DDoS attack on your unprotected IP, they will “blackhole” (null-route) your IP to protect their data center, taking you offline. Always route external traffic through Alibaba Cloud Web Application Firewall (WAF) and Anti-DDoS Pro.

2. Multi-AZ Deployments

Do not rely on a single Availability Zone. While Alibaba’s infrastructure is generally world-class, regional power issues and fiber cuts happen. Distribute your ACK worker nodes and PolarDB read-replicas across at least two AZs (e.g., cn-beijing-h and cn-beijing-k) to ensure sub-second failover.

3. Use RAM Roles, Not Access Keys

Never hardcode Alibaba Cloud Access Keys in your application code or environment variables. I’ve seen leaked AK/SK pairs result in Bitcoin mining botnets spinning up 500 GPU instances in hours. Use Resource Access Management (RAM) roles bound securely to your ECS instances or ACK worker nodes.

Terraform Snippet: Secure RAM Role Assignment

Terraform

# Create a RAM Role
resource "alicloud_ram_role" "app_role" {
  name     = "app-server-role"
  document = <<EOF
  {
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": { "Service": ["ecs.aliyuncs.com"] }
      }
    ],
    "Version": "1"
  }
  EOF
}

# Attach Role to ECS via Instance Profile
resource "alicloud_ram_role_attachment" "oss_read_access" {
  role_name    = alicloud_ram_role.app_role.name
  policy_name  = "AliyunOSSReadOnlyAccess"
  policy_type  = "System"
}

11. Common Mistakes and Failures

Even seasoned Principal Engineers stumble when they cross the firewall for the first time. Watch out for these catastrophic errors:

• Forgetting the PSB Filing: Getting your ICP Bei’an is only step one. It gets your domain unblocked by the ISPs. But within 30 days of your website going live, you must complete the Public Security Bureau (PSB) filing. I’ve had panicked clients call me because they woke up to an unannounced server shutdown by the local police—simply because they thought the initial ICP was the end of the paperwork.
• Relying on Global DNS Providers: Do not point your mainland domain to AWS Route53 or standard Cloudflare DNS. These global DNS nameservers are frequently throttled or poisoned in China, leading to DNS resolution times exceeding 1,000ms. Use Alibaba Cloud DNS (Alidns) for your mainland domains to guarantee sub-20ms resolution.
• Ignoring NTP Drift: Make sure your ECS instances are syncing time with mainland NTP servers (like ntp.aliyun.com). Relying on pool.ntp.org can result in UDP packets being dropped, leading to clock drift. If your clock drifts by more than 15 minutes, your STS tokens and OSS API calls will start failing with cryptic SignatureDoesNotMatch errors.

12. Conclusion: Don’t Let Infrastructure Block Your Market Entry

Successfully hosting a production application in China is a multi-disciplinary effort. It requires a flawless blend of strict regulatory compliance, specialized cloud architecture, and a deep, battle-tested understanding of domestic networking behavior and scaling limitations.

If you get it wrong, your site is IP-blocked, your TCP connections drop constantly, your CI/CD pipelines hang, and your launch is delayed by months.

But if you get it right? You unlock seamless, sub-100ms access to one of the largest, most lucrative digital economies in the world.

Stop guessing with complex cross-border topologies. Stop risking your database integrity on cheap public VPNs. And stop letting compliance paperwork stall your engineering roadmaps.

We Build China-Optimized Infrastructure

You have the roadmap. Now, get the right engineers to help you build it. We act as an extension of your DevOps team, taking the risk and the learning curve out of your China launch.

Engage with our certified Alibaba Cloud architects to:

• Map out your ICP and PSB compliance strategy (and let our local teams handle the filings for you).
• Design a high-availability, multi-AZ VPC in Beijing, Shanghai, or Shenzhen.
• Establish secure, packet-loss-free CEN links back to your global AWS, GCP, or Azure data centers.
• Implement automated IaC pipelines specifically tailored for the mainland internet, including localized ACR registries and SLS monitoring.

Ready to turn your China strategy into a deployed reality without burning out your engineering team?

👉 [Schedule Your Technical Discovery Call Now] and launch in China with absolute confidence.

Read more: 👉 Load Balancing on Alibaba Cloud (SLB): Setup and Scaling Guide

Read more: 👉 Alibaba Cloud VPC Architecture Explained: Design Secure Networks