Damage to three Amazon Web Services facilities in the Middle East from Iranian drone strikes highlights the rapid growth of data centers in the region, as well as the industry’s vulnerability to conflict.
The company’s cloud computing division, Amazon Web Services, said late Monday that two data centers in the United Arab Emirates were “directly struck” and another facility in Bahrain was also damaged after a drone landed nearby.
“These strikes have caused structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage,” AWS said in an update on its online dashboard.
It said by late Tuesday that recovery efforts at the UAE data centers were making progress.
Unlike previous AWS disruptions involving software that resulted in widespread global outages, these attacks involving physical damage appear to have resulted only in localized and limited disruption.
Amazon Web Services hosts many of the world’s most-used online services, providing behind-the-scenes cloud computing infrastructure to many government departments, universities and businesses.
The company advised customers using servers in the Middle East to migrate to other regions, and direct online traffic away from the UAE and Bahrain.
“Amazon has generally configured its services so that the loss of a single data center would be relatively unimportant to its operations,” said Mike Chapple, an IT professor at the University of Notre Dame’s Mendoza College of Business.
Other data centers in the same zone can take over, and most of the time this happens seamlessly every day to balance workloads, he said.
“That said, the loss of multiple data centers within an availability zone could cause serious issues, as things could reach a point where there simply isn’t enough remaining capacity to handle all the work.”
Amazon doesn’t typically disclose the exact number of data centers it operates around the world.
It says only that its data centers are clustered in 39 geographic regions, with three such regions in the Middle East, covering the United Arab Emirates, Bahrain and Israel.
Each AWS region is split up into at least three data center availability zones, with each zone isolated and physically separated “by a meaningful distance,” although they are all within 100 kilometers (60 miles) of each other and connected by “ultra-low-latency networks” that reduce the time lag for data transmission.
AWS says its data centers have redundant water, power, telecom, and internet connections “so we can maintain continuous operations in an emergency.”
They also have physical security, but those measures, including security guards, fences, video surveillance and alarm systems, are designed to keep out intruders rather than defend against missile attacks.
Chapple said the attacks are a reminder that cloud computing isn’t “magical” and “still requires physical facilities on the ground, which are vulnerable to all sorts of disaster scenarios.”
Data centers run by AWS and other operators are massive facilities that are hard to hide, he added.
“Organizations using services from any cloud provider in the Middle East should immediately take steps to shift their computing to other regions,” Chapple said.
Related: Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low
Related: Cyber Insights 2026: Cyberwar and Rising Nation State Threats
