Cloud architecture diagrams usually treat an availability zone failure as the worst realistic case and a whole-region loss as a thought experiment. In 2026 AWS customers in the Middle East found out what the thought experiment looks like.

What happened in March

Over the weekend of February 28 to March 1, 2026, drone strikes damaged AWS infrastructure in the Gulf. In status updates reported by BleepingComputer, AWS said two of its facilities in the UAE region (ME-CENTRAL-1) had been struck directly, and that a strike near a facility in Bahrain (ME-SOUTH-1) had caused physical damage.

AWS described structural damage, disrupted power delivery and water damage from fire suppression. Two UAE zones, mec1-az2 and mec1-az3, were reported as significantly impaired, and one Bahrain zone had a localised power problem.

The advice to customers was blunt: activate disaster recovery plans, restore from backups held in other regions, and move traffic out.

What changed in September

The story did not end with the repairs. Reuters reported that a second Bahrain zone was disrupted in April, leaving the whole region unavailable. (InfoQ also mentions a claimed second attack in July; reports differ on that timing.)

On September 15, AWS told customers it could not restore resources and data held only in mec1-az2 in the UAE, or held only in the Bahrain region. According to InfoQ and Reuters, AWS said the Bahrain damage went beyond what its regional and multi-zone services are designed to survive. Recovery work continues in the other two UAE zones, with AWS promising an update “in the coming months” for the UAE and in early 2027 for Bahrain.

We have not found a formal AWS post-event summary; the details here come from AWS’s status communications as reported by the outlets linked below.

Why it matters

  • Multi-AZ is not disaster recovery. Spreading across zones protects against a building losing power. It does not protect against an event that takes out a region.
  • Cross-region copies are your job. Under AWS’s shared responsibility model, keeping data in a second region is the customer’s decision and cost. Teams that relied on one region’s durability had nothing to restore from.
  • Data residency makes this harder. Some customers keep data in-country for legal reasons. For them, a second region may mean a second country, which is a compliance conversation, not just a Terraform change.

What to check this week

If you run anything in a single region, ask three questions: where is the most recent copy of each critical dataset outside that region, how long would a restore actually take, and when did you last test it? The AWS Middle East incident turned those from audit questions into a real event.

Sources

  1. BleepingComputer: Amazon says drone strikes damaged AWS data centers in Middle East (Mar 3, 2026)
  2. Khaleej Times / Reuters: Amazon AWS unable to restore access to Bahrain, one UAE cloud data zone (Sep 16, 2026)
  3. InfoQ: AWS confirms permanent data loss in Middle East regions (Sep 21, 2026)
  4. Techzine: AWS can’t recover all data from data centers hit in Middle East (Sep 16, 2026)

We link every claim to the reporting or official statement it comes from. Where a detail rests on one outlet’s reporting, we say so. Spotted an error? Reply to any newsletter and we’ll correct it.