Most businesses treat the cloud as a place that doesn’t really exist anywhere, just servers somewhere out there, always on. The war between the United States and Iran has punctured that assumption pretty thoroughly. Amazon‘s cloud region in Bahrain has sat effectively offline since spring, and a second region in the UAE has been running at reduced capacity, both because the physical buildings took real damage.
The timeline reads like a slow-motion disaster. In early March, drones struck two AWS facilities in the UAE over a single weekend, knocking two of the region’s three data center zones offline after a fire triggered sprinklers and wrecked equipment. A separate strike near Bahrain damaged infrastructure there too. Late March brought a second disruption to the Bahrain region. Then on April 1, a fire broke out at what reporters identified as an Amazon data center in Bahrain, one the country’s government blamed directly on Iranian attacks. No one got hurt at either site, but the disruption hit businesses almost immediately, reaching banks, payment services, and apps like Careem.
Months later, Amazon’s own status page still shows Bahrain as unavailable, with its last update dated April 30. The company has stopped talking about repairs and now simply tells customers to move their systems elsewhere, and it waived UAE service charges for March. This is not a typical outage anyone measures in hours. It runs in months, because no software update fixes a burned building.
Amazon builds redundancy into each region so one zone failing does not take everything down. That design accounts for accidents: storms, power failures, equipment malfunctions. Nothing in it anticipated a strike capable of disabling multiple zones at once, which is exactly what happened in the UAE.
Under Amazon’s shared responsibility model, spreading workloads across multiple regions, not just multiple zones within one region, has always been the customer’s job, not Amazon’s. Companies that trusted multi-zone redundancy inside Bahrain as sufficient protection found out how wrong that assumption was when the entire region went dark.
There’s also a financial sting most people haven’t considered. Standard business insurance often excludes acts of war, and Iran has publicly claimed these strikes as exactly that. Legal analysts have noted that force majeure protections may not apply either, since disruption in an active conflict zone is arguably foreseeable rather than a surprise.
None of this means cloud hosting is unreliable. It means treating your data’s physical location as a real decision, not a technicality, might matter more in 2026 than it ever has before.
