Iranian Drone Strikes on AWS Data Centers Mark the First Wartime Attack on Hyperscale Cloud Infrastructure
Iranian drones struck three AWS facilities in the UAE and Bahrain, knocking two availability zones offline and challenging the cloud industry's core resilience assumptions.
Overview
In the early hours of March 1, 2026, Iranian drones struck two Amazon Web Services data centers in the United Arab Emirates and damaged a third facility in Bahrain, according to The Register. The attacks knocked two of the three availability zones in AWS’s ME-CENTRAL-1 region offline and disrupted services in Bahrain’s ME-SOUTH-1 region, marking what analysts believe to be the first confirmed military strike on hyperscale cloud infrastructure.
The incident has forced the cloud industry to confront a question it has largely avoided: whether multi-availability-zone architectures, designed to survive hardware failures and localized disasters, can withstand the kinetic realities of armed conflict.
What We Know
The strikes targeted AWS facilities in the ME-CENTRAL-1 (UAE) and ME-SOUTH-1 (Bahrain) regions. According to The Register, the mec1-az2 and mec1-az3 availability zones in the UAE were significantly impaired, while mes1-az2 in Bahrain sustained damage from a drone strike in close proximity. The disruptions were first reported at 12:51 UTC on March 2.
The physical damage was extensive. AWS confirmed that the strikes caused “structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage,” as reported by CBS News. Sprinkler activation added water damage to equipment already affected by the initial impacts, and local authorities cut power to contain fires, according to The Register.
Core AWS services including S3, EC2, DynamoDB, Lambda, and RDS experienced elevated error rates and degraded availability across the region, per InfoQ. S3 storage experienced “high failure rates for data ingest and egress” as the simultaneous loss of two zones exceeded its single-zone failure tolerance, according to The Register. AWS cautioned that recovery would take “at least a day” due to the need to repair facilities, cooling, and power systems.
The downstream impact was significant. Ride-sharing platform Careem, payment firms Hubpay and Alaan, data management company Snowflake, and several major UAE banks — including Emirates NBD, First Abu Dhabi Bank, and Abu Dhabi Commercial Bank — all reported service disruptions, according to CBS News. Amazon stock declined $3.40 (1.6%) to $204.99 in early trading following the news, per CBS News.
Iran’s Islamic Revolutionary Guard Corps stated that it targeted the Bahrain facility specifically because AWS hosts U.S. military workloads there, according to Fortune. The attacks came in the wake of coordinated U.S. and Israeli military strikes against Iran, which also triggered retaliatory cyberattacks against U.S. military IT infrastructure.
What We Don’t Know
The full extent of data loss, if any, remains unclear. AWS advised customers to “backup data and potentially migrate workloads to alternate AWS Regions” given the unpredictable environment, according to The Register, but has not disclosed whether any customer data was permanently lost.
It is also unknown whether other cloud providers operating in the region — including Microsoft Azure and Google Cloud, both of which maintain Middle East regions — have taken additional physical security measures in response. The degree to which U.S. military workloads were affected has not been publicly confirmed beyond Iran’s claims about the Bahrain facility’s military significance.
Analysis
The attacks expose a fundamental tension in cloud architecture. Multi-AZ deployments are marketed as the standard approach to high availability, but they were designed for hardware failures, software bugs, and natural disasters — not missile strikes. As Harshwardhan Choudhary of ABN AMRO put it, according to InfoQ: “Multi-AZ is NOT disaster recovery. It protects from hardware failures, not missiles.”
The blurring of civilian and military cloud infrastructure compounds the problem. The Pentagon’s Joint Warfighting Cloud Capability and Joint All-Domain Command and Control networks operate on the same commercial infrastructure that serves civilian businesses, according to Fortune. Zachary Kallenborn of King’s College London warned in the same report that “if data centers become critical hubs for transiting military information, we can expect them to be increasingly targeted by both cyber and physical attacks.”
Sam Winter-Levy of the Carnegie Endowment described the strikes as “a harbinger of what’s to come,” noting in Fortune that data center vulnerability extends beyond direct hits — “knock out some of the chillers you can take them fully offline.” Former NSC technology policy official Chris McGuire went further, suggesting in the same piece that data centers in vulnerable regions may need missile defense systems.
The incident also carries implications for the Gulf region’s ambitions as a global AI hub. AWS committed $5 billion to a Saudi Arabia AI hub, and the planned Stargate UAE campus was positioned as the largest AI facility outside the United States, according to Fortune. Seventeen submarine cables transit the Red Sea carrying the majority of data traffic between Europe, Asia, and Africa. Doug Madory of Kentik warned that the simultaneous closure of these cable routes and the Strait of Hormuz would be “a globally disruptive event” of unprecedented scope, per the same report.
Gregor Hohpe argued that the risk is regional rather than vendor-specific, and that multi-cloud strategies do not address geopolitical threats, according to InfoQ. The implication is that enterprises dependent on Middle Eastern cloud regions must adopt multi-region — not just multi-AZ — disaster recovery plans, with failover targets in geographically distant and geopolitically stable locations.
The March 1 strikes have redrawn the threat model for cloud infrastructure. For the first time, a state actor deliberately targeted commercial cloud facilities in wartime, treating them as legitimate military objectives. The cloud industry’s response to this precedent will shape infrastructure planning, pricing, and insurance models for years to come.