The "cloud" is no longer abstract. It has a physical address, turbines, air conditioning units, and in the Middle East this week, it has been hit by drones.
Iran's Islamic Revolutionary Guard Corps has pinpointed 29 locations across Bahrain, Israel, Qatar, and the United Arab Emirates that house offices, datacentres, and research facilities, according to reporting from Iran's state-affiliated Tasnim news agency. The list includes five Amazon facilities, five Microsoft, six IBM, three Palantir, four Google, three Nvidia, and three Oracle buildings.
This is not idle rhetoric. Three AWS sites in the United Arab Emirates and one in Bahrain were damaged by drone strikes, disrupting services across the region and underscoring how critical data infrastructure is emerging as a potential target in modern warfare. Iran cited Amazon's support for US military operations as justification for the strikes.
The practical impact was immediate and stark. The AWS damage created outages for a range of consumer and financial services, including delivery and ride-hailing app Careem and payment service Alaan. For the first time in recorded conflict, commercial cloud infrastructure essential to civilian economies has been deliberately targeted with kinetic force.
The strategic calculus here matters. US military used Anthropic's AI model Claude for intelligence assessments, target identification, and battle simulations during Iran strikes. That dual-use reality means attacks on commercial data centres can have immediate military consequences, and vice versa. In other words, the infrastructure powering a startup's cloud computing also supports government and military operations. When Iran strikes a data centre, it strikes both.
Cheap energy and land have drawn US hyperscalers to pour resources into building out capacity in the region in recent years. Oracle, Nvidia and Cisco are all involved in OpenAI's AI campus in the UAE, dubbed Stargate, which will span 10 square miles and include a 5-gigawatt capacity. These are not small bets. Saudi company Humain is pouring billions of dollars into AI infrastructure buildouts and Microsoft said it would invest 15 billion dollars into the UAE by 2029.
Yet a counterargument deserves serious weight. Whilst the Iran war will likely not see hyperscalers walking away from existing AI infrastructure builds in the region, it could impact future investment in the case of drawn-out hostilities. Companies are now running cost-benefit analyses they did not contemplate weeks ago. Attacks on UAE and Bahrain data centres will lead to more efforts building up data centre resilience, experts say. That resilience costs money, time, and engineering resources.
The broader geopolitical context amplifies the risk calculation. The UAE absorbed by far the largest volume of attacks: 1,422 detected drones and 246 missiles between 1 and 8 March, meaning the UAE alone accounts for roughly 55 percent of all recorded strikes and 66 percent of all detected drones. In operational terms, this suggests the UAE has functioned as the campaign's principal target set, likely because of its concentration of commercial hubs, logistics infrastructure, and high-value military and economic assets.
Some experts see a silver lining. The attacks on UAE and Bahrain data centres will lead to more efforts building up data centre resilience, experts say. In the Middle East, cloud providers will commit to "multi-AZ" deployments—saving replicas of data in separate data centres. Globally, companies and governments will expect data centre providers to have recovery plans and multiple facilities within a country. This is essentially saying that disaster recovery will move from a best practice to a non-negotiable requirement.
But the real question is whether this fundamentally changes how the tech industry behaves. Physical security of cloud infrastructure was barely on the radar of most companies or regulators before this week. Governments have been increasingly acknowledging the strategic importance of data centres in recent years. The US recognises them as part of its 16 critical infrastructure sectors; the UK designated them as critical national infrastructure in 2024; and the EU also gives them special status. That recognition may now force tougher choices about where to build and how to defend these assets.
For Australia's tech and startup ecosystem, the implications are indirect but real. Australian companies relying on Middle Eastern data centres for AI training, content delivery, or regional expansion may face service disruptions or need to reroute infrastructure. Australian investment in Middle East tech ventures will now require geopolitical risk assessments that would have seemed overwrought a month ago.
The tech industry often speaks of data as if it were weightless and untethered from geography. This week demonstrated that the cloud has weight, address, and vulnerability. That realisation will reshape investment decisions, government policy, and corporate security strategies for years to come.