For years, the Gulf states sold themselves as the next frontier for artificial intelligence — cheap energy, abundant land, friendly regulators. Then Iran sent drones into the data centers.

Before dawn on March 1, Iranian Shahed drones struck two Amazon Web Services facilities in the United Arab Emirates. A third data center in Bahrain was hit. On April 1, Iranian forces struck the Bahrain facility again, igniting a fire. An Oracle data center in Dubai was reportedly hit on April 2. In between, the Islamic Revolutionary Guard Corps issued an extraordinary threat: 18 American technology companies — Amazon, Microsoft, Google, Apple, Nvidia, Meta, and others — were now considered military targets.

The AWS regions serving the Gulf are effectively offline. According to an internal Amazon memo obtained by Big Technology, both the Dubai (DXB) and Bahrain (BAH) regions have been classified as “hard down” — completely unavailable. The memo states that the two regions “continue to be impaired, and services should not expect to be operating with normal levels of redundancy and resiliency.” Amazon has no timeline for restoring either.

This is, by multiple accounts, the first time a nation has deliberately targeted commercial cloud infrastructure during an armed conflict. The implications extend well beyond the Middle East.

What went down

Each AWS region contains three availability zones — physically separated clusters of data centers designed to provide backup for one another. In both Dubai and Bahrain, multiple zones are either hard down or “impaired but functioning,” according to the Amazon memo. The company has directed employees to deprioritize these regions and is working to migrate customer workloads elsewhere.

The immediate damage was not limited to Amazon’s own infrastructure. As AWS buckled, cascading failures spread through dependent systems. Banking sites, payment processors, and consumer services across the region crashed as redundancies were overwhelmed, according to Winbuzzer. The disruption hit the UAE’s banking system particularly hard.

AWS customers who had not planned for regional failure were caught flat-footed. Amazon has warned customers to migrate workloads to unaffected regions, and a “large number” have already done so, the company said in a March 24 blog post. But migration is neither simple nor instantaneous — particularly for workloads involving large datasets or strict data-residency requirements.

Why data centers

Iran has framed the strikes as attacks on “enemy technology infrastructure” supporting US military and intelligence activities. The IRGC claimed the targeted data centers were supporting “the enemy’s” military and intelligence activities. That claim is difficult to verify. US law requires cloud providers storing government and military data to keep it within the United States or on Department of Defense bases, according to researchers at Just Security. Moving such data to Gulf-region data centers would require special authorization, and there is no public evidence that has been granted.

The more likely explanation involves a combination of convenience and symbolism. The Conversation notes that Iran launched thousands of missiles and drones at the UAE and Bahrain during this period. The vast majority were intercepted. The four that struck data centers were a small fraction of the projectiles that reached civilian targets, including airports and hotels. Data centers are large, fixed, physically fragile, and lack dedicated air defenses — attractive targets of opportunity for weapons that evade interception.

But the symbolism matters. The Gulf had become a showcase for American tech investment, particularly in AI. Palantir, which builds data architecture for the Pentagon’s AI targeting programs, maintains an office in Abu Dhabi. Meta was building a subsea cable through the region to boost African internet connectivity — a project now paused. Steffen Hertog, a Gulf economies expert, warned that the majority of non-energy investors had “underpriced risk” before the war, including US tech companies that flocked to the region for cheap power and favorable economics.

The supply chain beneath the cloud

The damage to digital infrastructure runs parallel to a quieter crisis in the physical supply chains that sustain it.

Qatar, which produces roughly one-third of the world’s helium, halted production after Iranian strikes on two LNG facilities. QatarEnergy told Reuters that the attacks wiped out 17 percent of the country’s LNG export capacity, and that repairs could take three to five years. Helium is essential for semiconductor manufacturing — chipmakers use it to cool silicon wafers during the etching process. Manufacturers typically hold no more than two months’ supply. Helium suppliers are already sending force majeure notices to chipmakers and electronics manufacturers.

Cliff Cain of Pulsar Helium told CBS News that semiconductor manufacturers have already indicated they will not meet their 2030 manufacturing goals. “Everything from vehicle chips to iPhones will definitely be affected,” he said. Yvette Connor, a risk advisory leader at CohnReznick, said the helium shortage could slow American AI companies’ growth — constraining the buildout of the very data centers now being bombed.

Aluminum prices have hit a four-year high. The Gulf produces roughly 9 percent of global supply, and disruptions there are tightening markets alongside rising energy costs. Oxford Economics analysts Stephen Hare and Sebastian Tillet told CBS News that reduced supply and rising costs are “pushing aluminum prices higher” across the global market.

A new category of target

The US-Iran conflict began on February 28, following the assassination of Iranian Supreme Leader Ali Khamenei. Since then, approximately 2,000 Iranians and at least 13 American service members have been killed. The Strait of Hormuz has been disrupted for weeks, choking oil supplies and driving US gasoline prices to $4 a gallon for the first time since August 2022.

Within this larger war, the targeting of cloud infrastructure represents something new. Data centers have been hit by cyberattacks. They have been swept up in conflicts. But no nation had treated them as strategic targets for physical destruction until now.

Former CISA Director Chris Krebs described an “all hands on deck approach by Iran,” with military units, intelligence services, proxy groups, and hacktivists all targeting infrastructure simultaneously. Iran-linked hacking group Handala has already claimed responsibility for a cyberattack on medical technology firm Stryker that caused a “global network disruption.” APT42, another Iranian group, was found using Google’s Gemini AI for social engineering campaigns in February, according to Winbuzzer.

Major cloud providers are expected to overhaul data center security in response to the Iranian attacks. The details of such proposals have not been made public, but the direction is clear: the glass houses the cloud industry built in the Gulf are not survivable in a war zone.

The cloud was supposed to be resilient by design — data replicated across zones, regions, and continents. That architecture assumed hardware failures and natural disasters. It did not assume artillery.

Amazon’s internal memo put it plainly: “We do not have a timeline for when DXB and BAH will return to normal operations.” Two major cloud regions are dark. The companies that built them are retreating. The industries that depend on them are scrambling for alternatives. The Gulf’s bet on becoming an AI hub is, for the foreseeable future, on hold.

Digital infrastructure is now as exposed as oil tankers and shipping lanes — a reality that an AI-powered newsroom reports on with full self-awareness. The cloud was never abstract. It is concrete and steel and silicon, sitting in buildings that burn when struck.

Sources