Iranian drone strikes damaged three AWS data centers in the UAE and Bahrain on March 1, knocking multiple availability zones offline. This marks the first confirmed military attack on a hyperscale cloud provider, causing structural and water damage that AWS warns will lead to a prolonged recovery.
The coordinated attack impaired the ME-CENTRAL-1 region by taking out two of its three zones, bypassing standard redundancy designs. This triggered widespread outages affecting major regional services, including banks, ride-sharing apps, and payment platforms.
Iran's Islamic Revolutionary Guard Corps claimed it targeted a facility in Bahrain because it hosts U.S. military workloads, though AWS declined to comment. The attacks followed recent joint U.S.-Israeli strikes on Iran.
The main topics covered are the cyber-physical attack on cloud infrastructure, the extent of the damage and service outages, the geopolitical context and claimed justification for the attack, and the impact on cloud redundancy models.
Iranian drone strikes hit three AWS data centers in the UAE and Bahrain — Iran confirms it targeted Amazon cloud infrastructure
Two of ME-CENTRAL-1's three availability zones went offline after Iran targeted Amazon's cloud infrastructure.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Drone strikes damaged three Amazon Web Services data centers in the UAE and Bahrain on Sunday, March 1, knocking two of the ME-CENTRAL-1 region's three availability zones offline and triggering outages across EC2, S3, DynamoDB, Lambda, RDS, and other core services, thereby marking the first confirmed military attack on a hyperscale cloud provider, according to Uptime Institute.
AWS confirmed on its health dashboard that two facilities in the UAE were "directly struck" and that a third site in Bahrain sustained damage from a nearby explosion. The strikes caused structural damage, disrupted power delivery, and, in some cases, triggered fire suppression systems that produced additional water damage, according to the AWS Health Dashboard. Amazon told customers it expects recovery to be prolonged "given the nature of the physical damage involved".
Each AWS region is built around multiple availability zones, which are physically separated data centers, each with independent power, cooling, and networking, designed so that the loss of one zone does not take a region offline. ME-CENTRAL-1 has three availability zones; the strikes took out two of them (mec1-az2 and mec1-az3), leaving the region significantly impaired. The Bahrain region (ME-SOUTH-1) lost one zone (mes1-az2) to a localized power issue. AWS's redundancy model is designed to survive the failure of a single zone, but not a coordinated attack across multiple sites within the same region.
These outages then cascaded into consumer-facing services across the Gulf. Ride-sharing and delivery platform Careem, payments firms Hubpay and Alaan, data management company Snowflake, and several major UAE banks — including Emirates NBD, First Abu Dhabi Bank, and Abu Dhabi Commercial Bank — all reported disruptions. AWS advised customers to activate disaster recovery plans and migrate workloads away from the affected Middle East regions.
Iran's Islamic Revolutionary Guard Corps stated it targeted the Bahrain facility specifically because AWS hosts U.S. military workloads there; AWS declined to comment on that claim. Sean Gorman, Air Force contractor and CEO of Zephr.xyz, told DefenseScoop on Tuesday that classified government workloads at Impact Level 4 and 5 are held in U.S.-only facilities, but acknowledged that “contractor and non-operational data… may have been impacted,” at the struck sites.
The attacks followed joint U.S.-Israeli strikes on Iran over the last week. AWS urged customers with workloads in the region to migrate to unaffected regions while repairs continue.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Luke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory.
-
TechieTwo Bad news for the IRGC as they are going to be decimated. May they rest in pieces... ;)Reply
Meridiano
