Six months of recovery work. Then Amazon admitted defeat on part of it. Two regions, three availability zones — the exact redundancy architecture built to survive a single facility failure, defeated by drone strikes that hit multiple zones inside the same war.
Amazon Web Services confirmed permanent customer data loss Tuesday in Bahrain and the UAE, six months after Iranian drone strikes damaged multiple facilities during the early stages of the 2026 Iran war. In status dashboard updates posted 15 September, AWS said it can no longer recover data hosted in its Middle East (Bahrain) region, known as me-south-1, or in one of three availability zones within its Middle East (UAE) region, known as me-central-1. “The damage to our infrastructure spanned multiple availability zones and exceeded what our regional and multi-AZ services are designed to withstand,” AWS said.
What’s Happening & Why It Matters
The Redundancy Model Assumed One Failure
Here’s the specific architectural assumption Iran’s strikes broke. AWS organises infrastructure into regions, each containing multiple availability zones —separate clusters of data centres built so a single site losing power or catching fire doesn’t take down the wider region. That design has protected AWS through countless individual facility failures over the years. It wasn’t built to survive coordinated strikes hitting several zones within the same region during an active shooting war.
The UAE loss is contained to one specific zone, mec1-az2, out of three. Work continues on the other two, mec1-az1 and mec1-az3, as well as shared regional infrastructure. The Bahrain loss is more total — AWS says it cannot restore access to resources hosted in the region. The distinction matters: this isn’t a full regional wipeout everywhere Iran struck, but it confirms that AWS’s resilience architecture had a breaking point, and Iran’s strikes found it.
From Fire to Permanent Loss
The damage traces back to 28 February 2026, when Iran launched a multiday series of missile and drone strikes against the UAE following coordinated Israeli-US strikes on Iran. AWS reported one of its UAE data centres on fire after being struck by “objects” at 4:30 am Gulf time, with power shut down afterwards. The Islamic Revolutionary Guard Corps later claimed responsibility for the Bahrain attacks, saying the facilities supported US military operations — a claim AWS has not confirmed or attributed.
AWS spent the following six months attempting recovery, suspending customer billing in the affected regions and issuing $150 million in customer credits after the initial strikes. Customers were urged to migrate resources elsewhere and restore from remote backups. The guidance is why the confirmation matters most for anyone who didn’t follow it — customer data that wasn’t backed up to a separate region before the strikes is, by AWS’s admission, unrecoverable.
A Cloud Infrastructure Case Study
This incident has already become a reference point for infrastructure engineers well beyond the immediate customers affected. Iran continued targeting Gulf states hosting US forces after the initial strikes, with a barrage against Kuwait among the more recent attacks — meaning the conflict driving this risk hasn’t resolved even as AWS closes the book on recovery. The UAE is revising its major AI data centre construction plans in response, considering measures including spreading facilities more across the country, building some underground, and adding blast-resistant concrete and air defences.
That regional infrastructure rethink is the more durable consequence here. A single cloud provider losing data in a war zone is serious but contained. A government revising its national data centre construction standards to withstand military strikes is a longer-term shift in how Gulf states approach the physical security of AI and cloud infrastructure — treating data centres as strategic targets requiring hardened construction, not just conventional commercial buildings.
TF Summary: What’s Next
AWS says it is committed to Bahrain customers long-term and expects to share a regional update in early 2027. Recovery work continues on the two unaffected UAE availability zones and shared regional infrastructure. AWS has not quantified the total volume of customer data lost or the number of affected customers. The UAE’s data centre construction plan revisions are under consideration, with no confirmed final specifications announced.
MY FORECAST: Expect this incident to be the standard case study cited whenever cloud providers discuss geopolitical risk in infrastructure planning, given how it demonstrates a documented limit of multi-availability-zone redundancy that engineers treated as close to failure-proof. Watch for AWS and its major competitors to review their Middle East and other conflict-adjacent regional deployments over the coming year — a redundancy model built to survive a fire or a power failure has a documented case where coordinated military action exceeded its design tolerance, and no major cloud provider wants to be the next one explaining permanent data loss to enterprise customers.
Related Stories
- FBI: Hackers Targeted Water Utilities in at Least 7 States
- GOLD EAGLE: White House Launches an AI Cybersecurity Clearinghouse
- Nvidia Buys Hugging Face for $12.9 Billion