In the early hours of March 1, Iranian Shahed drones struck three Amazon Web Services data centers in the Middle East — two in the United Arab Emirates and one in Bahrain.
The incident has since been described as the first time in human history a state actor deliberately used military force to strike commercial cloud infrastructure.
Six weeks later, the repercussions are still unfolding.
What happened
AWS operates two cloud regions in the Middle East: ME-CENTRAL-1 (UAE) and ME-SOUTH-1 (Bahrain).
The UAE region suffered the heaviest damage. It has three Availability Zones (AZs), of which mec1-az2 and mec1-az3 were both damaged, leaving only mec1-az1 operational. Under AWS's multi-AZ disaster recovery design, a single AZ failure is tolerable — but with two down simultaneously, many databases and applications deployed across AZs failed outright. The Bahrain region fared better, with most AZs intact, though one facility was also affected.
The outage impacted banking systems, payment services, food delivery apps, and enterprise software across the Middle East. AWS recommended that customers immediately migrate critical workloads to other regions — a recommendation that itself exposed a deeper contradiction, as discussed below.
Iran's Islamic Revolutionary Guard Corps (IRGC) and the official Iranian news agency Fars News both publicly acknowledged the attack, stating that the data centers supported U.S. military and intelligence operations, including parts of the Anthropic Claude intelligence analysis service running on AWS.
Why multi-AZ couldn't hold
The incident has sparked a valuable discussion among engineers.
AWS has long promoted the high availability of its multi-AZ architecture. But the typical failure scenarios it lists are power outages, lightning strikes, tornadoes, and earthquakes. No SLA document ever mentioned "military strike."
The fundamental issue is a physical constraint: to ensure low latency, multiple AZs within the same region must be geographically close — AWS requires them to be within 100 kilometers. This means all "redundancy" sits within the same geopolitical risk zone. A single missile or a swarm of drones can potentially cover multiple AZs.
One infrastructure consultant put it bluntly:
"Multi-AZ is not disaster recovery. It protects you from hardware failure, not from missile strikes."
The physical structure of data centers also exposed vulnerabilities. These buildings are large and obvious targets — cooling units, diesel generators, and gas turbines are all exposed externally. If the air conditioning system is knocked out, servers overheat and automatically shut down, without needing a direct hit on the racks.
The data localization deadlock
AWS's emergency recommendation was to migrate workloads to other regions.
But for many Middle Eastern businesses, that path is simply blocked.
The UAE, Saudi Arabia, and other countries have strict data localization laws — financial, government, and medical data cannot be stored abroad. This means these companies have no choice: the data must stay in the local region, the very region that was just attacked by drones.
After the incident, AWS did not provide a clear recovery timeline, leaving customers to activate their own emergency plans. As of April 7, AWS engineering teams were still working 24-hour shifts to maintain services in the Middle East region.
The line between military infrastructure and commercial cloud has vanished
Why did Iran target commercial data centers rather than dedicated U.S. military facilities?
Because the boundary between the two has blurred to the point of nonexistence.
Parts of the U.S. Department of Defense's systems and intelligence analysis processes run on commercial AWS services. Anthropic's Claude is used for intelligence tasks, running on commercial AWS instances. This was previously an open secret within the industry; the attack has turned it into a concrete, consequential reality.
In a Fortune analysis, researchers concluded: This is not an isolated incident, but a preview of a new form of warfare.
As AI systems play an increasingly heavy role in military decision-making, the computing infrastructure behind them becomes a high-value strategic target. Whoever controls computing power, to some extent, controls the information advantage.
This logic is not new in theory, but March 1, 2026, added a specific, unavoidable footnote of reality to it.
This forces a change in cloud computing architecture thinking
From now on, cloud providers and enterprise customers must seriously consider a risk dimension that was previously dismissed: cross-region disaster recovery under geopolitical risk.
Multi-region disaster recovery and cross-cloud backups are no longer just compliance requirements for financial institutions. They should be a basic configuration for any business operating in geopolitically sensitive areas.
What is the cost? Higher costs, higher latency, and more complex architecture. But compared to a total service collapse after a drone attack, these costs may well be worth it.
Sources: War in Iran Damages Multiple AWS Data Centers, Challenging Multi-AZ Assumptions (InfoQ); Iranian attacks on Amazon data centers in UAE, Bahrain signal a new kind of war (Fortune); Amazon says drone strikes damaged 3 facilities in UAE and Bahrain (CNBC); CocoLoop; Iranian drone strikes at Amazon sites raise alarms over protecting data centers (Rest of World)