Six months after drone strikes damaged its data centres in the Gulf, Amazon Web Services has told customers it is “unable to restore access to the resources and data hosted exclusively” in its Bahrain region, me-south-1, and in one UAE Availability Zone, mec1-az2. In plain terms, data that lived only in those places is gone.
What AWS said
We covered the strikes in March, when Amazon confirmed that drones had hit two of its facilities in the UAE and damaged a third in Bahrain. The strikes began on 1 March 2026. Two UAE facilities were, in AWS’s words at the time, “directly struck”, while in Bahrain “a drone strike in close proximity to one of our facilities caused physical impacts”.
AWS described the damage in March as structural, with power delivery disrupted and, in some cases, fire suppression that “resulted in additional water damage”. This week’s update explains why restoring service has not been possible. According to Reuters, AWS said: “The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand.”
That sentence is the heart of the story. Cloud regions are built from several Availability Zones, separate facilities designed so that losing one does not take down the others. Spreading a workload across zones is the standard advice for resilience, and for most failures it works. Here, the damage reached more than one zone at once, and the protection that multi-AZ design offers ran out.
AWS says it will give an update on the UAE “in the coming months” and on Bahrain “in early 2027”.
By the numbers
| Item | Figure | Source |
|---|---|---|
| Date the strikes began | 1 March 2026 | The Register |
| UAE facilities directly struck | 2 | The Register |
| Bahrain region AWS cannot restore | me-south-1 | CNBC, Reuters |
| UAE Availability Zone AWS cannot restore | mec1-az2 | CNBC, Reuters |
| Time since the strikes | about 6 months | CNBC |
| Next update on Bahrain | early 2027 | Reuters |
What permanent loss means for customers
The key word in AWS’s statement is “exclusively”. Resources and data that also existed somewhere else, in another region or in a backup kept outside the affected sites, can be recovered from that copy. Anything that existed only in me-south-1 or only in mec1-az2 cannot.
For a company in the Gulf, that could mean a database with no copy elsewhere, customer files in a bucket that was never replicated, or server images never exported, plus the work of rebuilding what can be rebuilt somewhere else.
I want to be careful here. AWS has not published a list of affected customers or the volume of data lost, and I will not guess at either. What is clear is the principle, and it applies to every cloud customer in the region, not only those who used these two locations.
The lesson: keep a copy outside the region
Cloud resilience planning usually focuses on a failed server, a power cut in one hall or a bad update. This event adds a harder case: losing a whole region’s infrastructure at once.
My practical takeaways, based on what AWS has said and not on any figure it has published:
- Multi-AZ is not a backup. It protects you against losing one facility. It did not protect data in this case, because the damage crossed zones.
- Keep at least one copy of critical data in another region, and ideally in a region far from the first. A backup in the same region shares the same physical risk.
- Test restores, not just backups. A copy you have never restored from is a hope, not a plan.
- Know where everything lives. Many teams cannot say, today, which of their resources exist in only one place. That list is worth making this week.
- Plan for residency rules. Some organisations in the region are required to keep certain data inside a country. If that applies to you, talk to your provider and your regulator about how to keep a second copy that still meets those rules, rather than keeping no second copy at all.
None of this is new advice. What is new is that customers in our region now have a real and painful example of the case it was written for.
What to watch
- AWS’s update on the UAE, promised “in the coming months”.
- AWS’s update on Bahrain, promised for early 2027.
- How cloud customers and regulators in the Gulf respond on backup and continuity requirements.
Sources
- CNBC, report that AWS cannot restore service in Bahrain and the UAE six months after the strikes, 15 September 2026, https://www.cnbc.com/2026/09/15/aws-cant-restore-service-to-bahrain-uae-6-months-after-iran-strikes.html
- Reuters via Insurance Journal, report on AWS’s statement about permanent loss in Bahrain and the UAE, 16 September 2026, https://www.insurancejournal.com/news/international/2026/09/16/885283.htm
- The Register, report on AWS confirming drone strikes on its data centres in the UAE, 2 March 2026, https://www.theregister.com/off-prem/2026/03/02/aws-says-drones-hit-two-of-its-datacenters-in-uae/4663049
- CBS News, report on the drone strikes on AWS data centres in the UAE and Bahrain, 3 March 2026, https://www.cbsnews.com/news/amazon-drone-strike-aws-data-center-uae-bahrain-iran/