Amazon Web Services posted a two-sentence notice to its health dashboard on September 15. "After a thorough assessment, we have determined that we are unable to restore access to the resources and data hosted exclusively in this region." The Bahrain cloud region is gone.
The posting was the company's first public update since April. It confirmed what six months of silence had implied. Data that customers stored exclusively in Bahrain, without cross-region replication, is permanently inaccessible. One of the UAE's three availability zones is similarly unrecoverable. Most affected customers migrated using backup restoration in other regions, AWS said. The company expects to provide a Bahrain update "in early 2027."
The Strike
In early March, Iranian drones struck two AWS data centers in the United Arab Emirates and damaged a third facility in Bahrain. The attacks came in the opening days of the Iran war, after U.S. and Israeli strikes hit military and nuclear sites across Iran. AWS reported structural damage, disrupted power delivery, and water damage from triggered fire suppression systems. Two of three availability zones in the UAE region went offline. EC2, S3, DynamoDB, Lambda, and RDS failed simultaneously.
Iran's Islamic Revolutionary Guard Corps claimed responsibility. It said it targeted the Bahrain facility specifically for Amazon's support of the U.S. military. Careem, the delivery and ride-hailing platform, and Alaan, a payments service, were among the companies affected. Banking operations across the Gulf were disrupted, with customers unable to access financial data hosted in the affected zones.
The Escalation
In July, the IRGC struck again with cruise missiles. Two AWS facilities at Zallaq and Askar in Bahrain were hit. Iran's state-affiliated Tasnim agency published photographs of the damage. Lower-resolution imagery from the European Space Agency's Sentinel-2 constellation, reviewed by analysts at Bloomberg Economics and the conflict-monitoring organization ACLED, confirmed structural damage and burn signatures matching the IRGC's claimed timeline of July 18 to 24.
AWS has not publicly confirmed the July strikes. But the September 15 admission that Bahrain cannot be restored encompasses damage from both waves.
The Assumption
Cloud computing's foundational architecture is redundancy. AWS organizes its global infrastructure into regions, each containing multiple availability zones with independent power, cooling, and networking. The design assumes that one zone can fail while others continue operating. Customers who replicate data across zones maintain availability through any single point of failure.
Bahrain broke the assumption. AWS acknowledged the damage "exceeded what our regional and multi-AZ services are designed to withstand." The architecture accounts for equipment failure, software bugs, and natural disasters. It does not account for cruise missiles aimed at multiple facilities in sequence. Mike Chapple, a professor of IT analytics at the University of Notre Dame, warned that "the loss of multiple data centers within an availability zone could cause serious issues" with insufficient capacity remaining. What happened in Bahrain went further. Every zone in the region was compromised.
This was the first time a sovereign actor deliberately targeted commercial cloud infrastructure during wartime. AWS operates three availability zones each in the UAE, Bahrain, and Israel, with three more planned for Saudi Arabia. Every one of those locations is now a target in a way that a software abstraction cannot disguise.
The Gap
Four days before the September 15 posting, this journal documented that zero dollars of data center risk had reached the catastrophe bond market. A single hyperscale campus can carry between $20 billion and $30 billion in insurable value, roughly a third of the $66 billion in catastrophe bonds outstanding worldwide. Swiss Re projects that data centers and renewable energy infrastructure will generate $200 billion in cumulative commercial insurance premiums between 2026 and 2030. The first dedicated data center catastrophe bond was expected within 12 to 18 months.
The Bahrain region was destroyed before that bond was written. The gap between the infrastructure's value and the instruments covering it remains total.
The Redesign
The United Arab Emirates is rethinking its AI infrastructure strategy. The Stargate UAE project, a $30 billion campus originally planned as a single 5-gigawatt facility spanning 10 square miles, is being redesigned as a dispersed network of smaller facilities. G42 subsidiary Khazna Data Centers is building it with OpenAI, Oracle, Nvidia, Cisco, and SoftBank as consortium partners. The first 200 megawatts of capacity were due to come online this year.
The revised approach includes underground construction, blast-resistant concrete, and mountain locations for sensitive data, according to Reuters.
Sam Winter-Levy of the Carnegie Endowment for International Peace noted that "physical attacks are only going to become more common moving forward as AI becomes more and more significant."
Amazon shares fell 2% on September 15 to $248.42, part of a slide that has taken the stock more than 13% below its 52-week high of $287.20. AWS remains the world's largest cloud provider with roughly 30% market share. The market had been pricing cloud infrastructure for infinite scalability. It had not priced the possibility that a region could be erased. The cloud had a physical address.