Iranian drones didn’t care about AWS redundancy guarantees when they struck three Amazon data centers in the United Arab Emirates and Bahrain two months ago. The facilities “suffered damage as a result of the conflict in the Middle East,” according to an April 30 AWS status update, and cannot currently support customer applications. Restoring normal operations, Amazon wrote, “is expected to take several months.”

According to Ars Technica, full recovery from the disruption could stretch to nearly half a year. The disruption has been ongoing since the strikes in early March, and AWS’s own language makes clear the end is not yet in sight — a staggering timeline for an industry that measures outages in minutes.

$150 Million and Counting

AWS has stopped billing customers in the two affected regions — ME-CENTRAL-1 (UAE) and ME-SOUTH-1 (Bahrain) — while repairs continue. The company already waived all usage-related charges for March 2026 at an estimated cost of $150 million, according to Ars Technica. The latest dashboard language suggests that billing suspension will extend well beyond a single month.

For Amazon, the direct financial hit is absorbable. AWS generates well over $100 billion in annual revenue. But the dollar figure understates the real cost. The signal matters more: the world’s largest cloud provider has acknowledged that its physical infrastructure in a conflict zone is exactly as vulnerable as any other physical infrastructure in a conflict zone. What AWS customers in the Gulf are learning — and what the rest of the industry is watching — is that no service-level agreement covers a missile.

AWS “strongly” recommended that customers migrate resources to other cloud regions and restore inaccessible data from remote backups. Some moved fast. Careem, the Dubai-based super app that handles ride-hailing, food delivery, and household services, completed an overnight migration to alternate servers and restored operations quickly, Ars Technica reported. Not every customer has that option — or the engineering teams to execute it under pressure.

Resilience Has Limits

Cloud computing’s value proposition rests on distributed resilience. Availability zones, multi-region architectures, geographic redundancy — the system is engineered to withstand failure. But the system was designed for technical failures: power grid fluctuations, hardware degradation, undersea cable disruptions. A drone strike operates in a different category entirely. It doesn’t disable a server rack; it destroys the building housing it, the power infrastructure feeding it, and potentially the supply chains required to rebuild it.

The Gulf states have been a growth market for AWS and its competitors. Amazon launched its Bahrain region in 2019 and its UAE region in 2022, positioning both as infrastructure gateways for regional enterprises and multinational corporations operating in the Middle East. The commercial pitch assumed operational stability. That assumption held until Iranian drones rendered it untenable.

The Expanding Economic Toll

The AWS damage illustrates a broader pattern in the Iran conflict: the economic fallout keeps finding new categories of infrastructure. Oil markets and shipping lanes came first. Insurance premiums and rerouted cargo followed. Now the consequences have reached cloud computing — the invisible backbone that governments, banks, hospitals, and logistics networks depend on to function.

The implications extend beyond Amazon. Any cloud provider with physical infrastructure in the Gulf — and several major competitors operate there — is now recalibrating risk assessments that almost certainly did not weight missile strikes heavily in their threat models. The cloud industry’s assumptions about physical risk are being rewritten in real time.

The incident is already accelerating conversations about cloud architecture that were previously theoretical — multi-cloud deployments, air-gapped backups, the geographic distribution of critical workloads across politically stable jurisdictions. These are engineering decisions that now carry geopolitical weight they did not carry two years ago.

AWS has not publicly detailed the full extent of physical damage across the three facilities. What the status dashboard makes clear is that “normal operations” remain a distant prospect — and that billing holidays, however welcome, are not a substitute for functioning infrastructure.

For an industry that sold the world on the idea that data exists everywhere and nowhere, the drone strikes delivered a bracing clarification. Data lives in buildings. Buildings are in places. Places can be attacked.

Sources