When Iranian missiles and drones began raining down across the Gulf region over the weekend, the damage was not confined to military installations. By Monday, the conflict had opened a new front: the cloud. Multiple Amazon Web Services availability zones in the United Arab Emirates and Bahrain were offline or severely degraded, after what Amazon described, with careful understatement, as "objects that struck the data center, creating sparks and fire."
The strategic implications are significant. The outages offer the clearest demonstration yet that modern conflict does not respect the distinction between military and civilian infrastructure. Data centres, once considered abstract and remote, are now squarely within the blast radius.
At 12:51 UTC on Monday, Amazon began investigating disruptions to its mec1-az2 availability zone in the UAE. Roughly five hours later, the company confirmed the facility had been struck by objects, prompting local authorities to cut power to contain the resulting blaze. Multiple AWS availability zones in the Middle East are experiencing outages or degraded connectivity after objects struck the UAE facility, as Iranian retaliatory missile and drone attacks hit targets across the Gulf. Amazon has not specified the nature of the objects, and the company declined to comment beyond directing media to its public health dashboard, as reported by The Register.
The situation worsened through the day. AWS also flagged separate connectivity and power issues affecting an availability zone in Bahrain, compounding disruption for customers running single-region workloads. By early evening UTC, a second UAE zone (mec1-az3) had been drawn into the outage. With two of three zones in the UAE region impaired, Amazon's S3 storage service — which is designed to absorb only the loss of a single zone — began reporting high failure rates for data ingest and egress, according to The Register. Disruptions to Amazon's facilities had knock-on effects for software-as-a-service providers in the region. On Sunday, data management firm Snowflake attributed service disruptions in the region to the AWS outage in the UAE.
The Bahrain disruptions carry their own grim context. Bahrain confirmed a missile attack had targeted the headquarters of the US Navy's 5th Fleet, which is hosted in the capital, Manama. Bahrain also shot down 45 Iranian missiles and nine drones, including Shahed-136 kamikaze drones. The AWS facility's "localised power issue" is almost certainly a downstream consequence of that broader infrastructure assault, though Amazon has stopped short of drawing the connection explicitly.
The strikes across the Gulf were themselves a response to a major joint US-Israeli operation launched on 28 February. On that date, Israel and the United States launched a coordinated joint attack on various sites in Iran, codenamed Operation Roaring Lion by Israel and Epic Fury by the US Department of Defense, targeting key officials, military commanders and facilities. The attack included the assassination of Supreme Leader Ali Khamenei. Tehran's retaliation has been sweeping. In the 36 hours since the war against Iran began, Tehran launched weapons towards Bahrain, Jordan, Kuwait, Iraq, Qatar, Saudi Arabia and the United Arab Emirates.
The UAE's Ministry of Defence said Iran fired 165 ballistic missiles, two cruise missiles and 541 drones at the country. Most were destroyed, but 21 drones hit civilian targets. Dubai's airport, the world's busiest for international traffic, and Kuwait's airport were also struck. The human cost in the UAE has fallen disproportionately on migrant workers: three people were killed, migrant workers from Pakistan, Nepal and Bangladesh.
For Australians, the conflict is not a distant abstraction. DFAT's Smartraveller advice now includes 'do not travel' warnings for Bahrain, Israel, Kuwait, Lebanon, Qatar, the UAE, Iran, Iraq, Palestine, Syria and Yemen. Foreign Minister Penny Wong cautioned that there are "limits" to what Canberra can do for the estimated 115,000 Australians currently in the region after dozens of aircraft were diverted or stranded. Airlines including Emirates and Qatar Airways have suspended or curtailed services, with Dubai, Doha and Abu Dhabi among the world's busiest connection points for Europe-bound travellers, meaning the ripple effect stretches far beyond the region itself.
The cloud infrastructure dimension of this conflict deserves scrutiny that goes beyond the immediate outage. Over the past decade, the Middle East has emerged as a hub for big tech, as wealthier nations in the region look to diversify their economies away from reliance on petroleum. Google, Amazon, Microsoft and Oracle all operate facilities in nations now under bombardment by Iranian forces. According to The Register, there are roughly 326 data centres across the Middle East, with the largest concentrations in Israel, Saudi Arabia and the UAE. Thus far, only Amazon's status pages report conflict-related outages, but the exposure is industry-wide.
One security analyst, Chris McGuire of the Council on Foreign Relations, observed on social media that, assuming the UAE incident was an Iranian drone strike, "it is the first time a commercial data centre was physically targeted in a conflict. It won't be the last." That assessment, however alarming, reflects a legitimate strategic reality. As Gulf states have raced to build AI and cloud capacity — partnering with Nvidia, AMD, OpenAI and others — they have concentrated enormous digital infrastructure in a region that was always, geopolitically, combustible. The return on that investment looked extraordinary when oil revenues were diversifying into server farms. It looks rather different when those server farms are in the crossfire.
The broader strategic picture resists easy resolution. Gulf leaders are caught between the United States, their primary security guarantor, and Iran. While most Gulf governments are wary of Iran, they have all tried to de-escalate tensions with the country and engage it diplomatically in recent years. The US, Bahrain, Jordan, Kuwait, Qatar, Saudi Arabia and the UAE issued a joint statement condemning Iranian attacks and affirming their right to self-defence, with Gulf countries warning they "will take all necessary measures" including "the option of responding to the aggression." Whether that language translates into direct military involvement, or remains a diplomatic signal, will shape the conflict's trajectory in the coming days.
What the AWS outages make concrete is a principle that security analysts have long theorised: in the 21st century, critical infrastructure and military targets are no longer clearly separated. For governments, businesses and insurers assessing risk in the region, the events of the past 72 hours have provided a costly proof of concept. Recovery at the affected AWS facilities is expected to take at least a day, requiring repair of cooling and power systems and careful safety assessments before operators can return. For the Gulf's digital economy, the repair bill is only beginning to be calculated. Australians with cloud-dependent operations in the region should be consulting their continuity plans now, not after the next strike.