AWS Confirms Irrecoverable Data Loss in Middle East Cloud Regions Due to Military Strikes
AWS has confirmed permanent data loss in its Middle East cloud regions following Iranian drone strikes, marking the first instance of irreversible data loss at a global cloud provider due to military action.
Amazon Web Services (AWS) has officially confirmed that some customer data hosted in its Middle East data centers, damaged by Iranian drone strikes in March and April, is permanently unrecoverable. This marks a significant and concerning milestone, appearing to be the first time military action has caused irreversible data loss at a major global cloud provider.
In an update posted to the AWS Health Dashboard on September 15, the company stated it was "unable to restore access to the resources and data" exclusively housed in the affected sites. Initial reporting by Reuters suggests the strikes inflicted catastrophic damage that overwhelmed AWS's resilience measures. This is the first public update from AWS on the incidents since April, and it provides the clearest admission to date that some data losses are permanent.
The damage was concentrated in specific availability zones. In the United Arab Emirates, the mec1-az2 zone suffered direct impacts from objects around 4:30 AM PST, leading to sparks and fire that ultimately rendered recovery efforts futile. While AWS is working to restore other zones in the UAE (mec1-az1 and mec1-az3), the data within mec1-az2 is lost. The situation in Bahrain was even more severe, with AWS unable to restore access to resources and data across the entire me-south-1 region.
AWS acknowledged that the "damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand." This statement is critical, as AWS architecture is typically engineered to withstand the failure of a single availability zone, not coordinated strikes impacting multiple zones simultaneously.
The disruptions began in March, following retaliatory actions by Iran after U.S. and Israeli attacks on Iranian targets. These strikes targeted Gulf states hosting U.S. military bases, leading to direct hits on two AWS facilities in the UAE and damage to a Bahrain facility from a drone strike. A first Bahrain zone was affected in March, with a second falling in April, rendering the region unavailable.
The incident underscores the shared responsibility model in cloud computing. While most AWS customers were able to re-establish operations in other regions using external backups, any data stored solely within the damaged footprint without an off-site copy has been lost entirely. Organizations utilizing these specific AWS regions are urged to audit their data residency and backup strategies to ensure no critical assets were exclusively located in the affected me-south-1 or mec1-az2 zones.
AWS has reportedly notified authorities in both Bahrain and the UAE, suspended regional billing for the affected services, and committed to providing further updates. Customers can expect more information on the UAE situation in the coming months, and on Bahrain in early 2027.
This event serves as a stark reminder that even the most robust cloud infrastructure is not immune to the physical impacts of geopolitical conflict. It highlights the need for organizations to consider a multi-region or even multi-cloud strategy for their most critical data, especially in regions with heightened geopolitical risk.
Six months after the initial Iranian drone strikes, AWS has officially confirmed that customer data and resources in its Middle East (Bahrain) region (me-south-1) are permanently lost. Additionally, one availability zone within the Middle East (UAE) region (me-central-1) has also suffered irrecoverable data loss. AWS stated that while most customers had already migrated or implemented alternative solutions, the damage in Bahrain was extensive, impacting multiple availability zones beyond the scope of its redundancy design.