Amazon has confirmed that drones directly struck two of its AWS data centres in the United Arab Emirates on 1 March, and that a strike close to a third facility in Bahrain caused physical damage there. It is the first confirmed military strike on a hyperscale cloud provider, and the disruption has reached banks, fintech companies and consumer apps that run their services from AWS in the region.
What Amazon has confirmed
The damage sits in two AWS regions. In the UAE region, ME-CENTRAL-1, the availability zones mec1-az2 and mec1-az3 went offline. In Bahrain, the ME-SOUTH-1 region lost its zone mes1-az2, according to DatacenterDynamics.
Amazon’s description of the damage is unusually direct for a cloud provider:
“These strikes have caused structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage.”
The company drew a distinction between the two countries. In the UAE, two facilities were “directly struck”. In Bahrain, Amazon told The Register that “a drone strike in close proximity to one of our facilities caused physical impacts”.
The customers named so far show how much of the Gulf’s digital economy sits on this infrastructure. DatacenterDynamics lists Careem, the ride-hailing and delivery app, the fintechs Alaan and Hubpay, the banks ADCB and Emirates NBD, and the data platform Snowflake among those affected.
I want to keep this story to what is confirmed. The strikes happened during an active war in the region, and this piece is about the infrastructure and the people who depend on it, not about the conflict itself.
By the numbers
| Item | Figure | Source |
|---|---|---|
| Date of the strikes | 1 March 2026 | The Register |
| AWS facilities directly struck in the UAE | 2 | The Register |
| AWS facilities damaged in Bahrain | 1 | DatacenterDynamics |
| ME-CENTRAL-1 (UAE) zones offline | 2 (mec1-az2, mec1-az3) | DatacenterDynamics |
| ME-SOUTH-1 (Bahrain) zones lost | 1 (mes1-az2) | DatacenterDynamics |
| Affected customers named publicly | 6 | DatacenterDynamics |
Why this matters for cloud customers in the Gulf
Cloud architecture rests on a simple promise. A region is divided into availability zones, which are separate groups of data centres with their own power and networking, so that a fire or a power cut in one zone does not take down a service built across several. Most resilience guidance, including AWS’s own, tells customers to spread workloads across zones inside a single region.
That guidance assumes failures are independent of each other. A physical attack breaks the assumption. In the UAE, two zones in the same region went down at the same time and from the same cause. An application that was “multi-AZ” on paper may have found most of its capacity gone at once.
What caught my attention is the list of names. These are not side projects. Banks and payment companies are among the most tightly regulated businesses in the UAE, and many firms in the region moved to local cloud regions precisely because they wanted, or were required, to keep data inside the country. That choice made sense, and it still does. It also means the obvious escape route, failing over to a region in another country, is not always legally or practically open to them.
For smaller companies and developers across the Gulf, the questions are more immediate:
- Which of your workloads, databases and backups live in mec1-az2, mec1-az3 or mes1-az2?
- Do you keep copies of critical data outside the affected region, and have you actually tested restoring from them?
- If your regulator requires in-country hosting, does your continuity plan cover losing more than one zone at once?
None of this is an argument for abandoning the cloud. A private server room in the same city would not have been any safer from a drone. It is an argument for treating physical risk as part of cloud design in this region, rather than an exotic edge case left for the appendix of a continuity plan.
What to watch
- How quickly AWS brings the affected zones in ME-CENTRAL-1 and ME-SOUTH-1 back into service, and whether it publishes a detailed account of the damage.
- What AWS tells affected customers about resources and data hosted in the damaged zones.
- Statements from the named companies, especially the banks, about service continuity for their own customers.
- Whether regulators in the UAE and Bahrain revisit what they expect from regulated firms when planning for the loss of local cloud capacity.
Sources
- DatacenterDynamics, “Amazon confirms two UAE data centers hit by drone strikes, third in Bahrain damaged”, March 2026, https://www.datacenterdynamics.com/en/news/amazon-confirms-two-uae-data-centers-hit-by-drone-strikes-third-in-bahrain-damaged/
- CBS News, report on Amazon’s confirmation of drone strikes on AWS data centres in the UAE and Bahrain, 3 March 2026, https://www.cbsnews.com/news/amazon-drone-strike-aws-data-center-uae-bahrain-iran/
- The Register, “AWS says drones hit two of its datacenters in UAE”, 2 March 2026, https://www.theregister.com/off-prem/2026/03/02/aws-says-drones-hit-two-of-its-datacenters-in-uae/4663049