The Islamic Revolutionary Guard Corps (IRGC) of Iran claims to have attacked Amazon Web Services (AWS) infrastructure in Bahrain with multiple cruise missiles. The organization states that the data center was destroyed, although neither Amazon nor Bahraini authorities have publicly confirmed this at the time of writing. This episode would be the third attack on AWS facilities in the country since March 2026.
Key facts about the AWS attack in Bahrain in 30 seconds
- The IRGC claims to have used cruise missiles against AWS infrastructure in Bahrain.
- Iran presents the operation as a response to a U.S. strike on the Darkhovin nuclear plant.
- Amazon has not confirmed that the data center was destroyed.
- The Bahrain region experienced physical damage and outages after drone attacks in March.
- The incident reopens the debate on cloud continuity, geographic separation, and physical exposure of data centers.
The Iranian claim was spread on July 21 by state media and outlets close to the IRGC. According to this account, the operation also included attacks on a U.S. radar in Muharraq and on a Patriot missile system in Riffa.
Iran has framed this new wave of attacks as retaliation for the U.S. bombing of Darkhovin, a nuclear power plant under construction in Juzestán province. The IRGC’s version has not yet been accompanied by verifiable images confirming the impact, exact location, or extent of damages.
Therefore, it is important to distinguish two facts: the attack has been claimed by Iran and reported by several international media, but the alleged total destruction of the facility remains an assertion by one party involved in the conflict.
A region of AWS hit multiple times since March
The Middle East (Bahrain) region, technically known as me-south-1, began operating in July 2019. It was AWS’s first region in the Middle East and was initially deployed with three availability zones, each designed with independent power, cooling, and connectivity systems.
This separation protects against technical failures and localized issues but does not eliminate risks when the same geographic area is exposed to sustained military campaigns.
AWS already confirmed in March that its Bahraini and United Arab Emirates data centers suffered physical impacts from drone attacks. At that time, they reported structural damages, fires, electrical outages, and issues caused by fire suppression systems.
Some regional services went offline, and Amazon warned that recovery would be lengthy. By late April, AWS acknowledged that restoring damaged operations could take several months and recommended customers migrate accessible resources or recover their workloads from backups stored in other regions.
The current claimed attack appears to have occurred while some recovery efforts were ongoing. Data Center Dynamics notes it as a new action against the same environment, though they have not been able to independently verify whether the missiles destroyed the facility.
Cloud services also depend on buildings, power, and connectivity
This incident highlights a reality often hidden behind concepts like high availability or cloud resilience: all digital services ultimately run on physical infrastructure.
Data centers rely on buildings, electrical connections, generators, cooling systems, fiber optics, staff, and supply chains. A distributed architecture can withstand server failures or the loss of a specific center, but war changes the nature of risks to consider.
Availability zones within the same region are physically separated, yet close enough to provide low-latency communication. That proximity, useful for rapid data replication, can be a vulnerability if multiple facilities fall within reach of the same drones or missiles.
Regional redundancy is not automatic for all services. Replicating an application across countries requires designing for inter-region operation, maintaining external copies, synchronizing databases, adjusting for latency, and incurring additional costs.
Regulatory obligations also come into play. Financial institutions, government agencies, and companies handling sensitive data cannot always move their data freely without considering jurisdiction, certifications, and contractual obligations.
The Gulf’s attractiveness as a unique location diminishes
Gulf countries have attracted significant investments in cloud and AI over recent years, thanks to their energy availability, digitalization plans, and demand for low-latency regional services.
Now, escalating military tensions introduce a factor that projects must weigh more heavily: geopolitical risk.
This doesn’t mean companies will broadly abandon Bahrain, the UAE, or Saudi Arabia. But it might accelerate the adoption of architectures maintaining a second operational copy outside conflict zones.
India appears as a relatively nearby alternative for certain Asian workloads. Germany and the Netherlands have high concentrations of data centers, international connectivity, and regions of major cloud providers. Other European markets, including Eastern countries like Romania, are also seeking to attract projects through available land, energy, and new fiber networks.
However, moving critical infrastructure isn’t just about renting capacity elsewhere. Projects need to consider latency, data sovereignty, electrical reliability, network routes, taxation, and service level agreements.
Claims of a massive shift of contracts from the Middle East to these regions are currently mainly based on commercial observations and industry contacts. There isn’t enough public data to confirm widespread relocations yet.
Data centers are becoming military targets
The most concerning consequence of the conflict is the evolving view of commercial digital infrastructure as a potential military target.
During March attacks, Iran argued that certain U.S. technology providers supported military and intelligence operations. This blurs the line between a commercial installation used by thousands of businesses and strictly defensive infrastructure.
The IRGC has also publicly pointed to facilities or projects linked to Microsoft, Oracle, Google, and other U.S. firms. Previously mentioned sites include the Stargate project in the UAE, although a public threat does not confirm an imminent operation against it.
The risk isn’t limited to equipment loss. A regional disruption can impact banks, payment platforms, transportation services, governments, and enterprise applications sharing the same provider and territory.
Therefore, business continuity plans should consider scenarios more severe than a simple outage. Critical organizations need to understand what would happen if a whole region became inaccessible for weeks or months, not just hours.
The technical priority is to keep copies outside the affected region, regularly test restoration capabilities, and reduce dependencies that prevent service recovery through another provider or territory. It’s also vital to document which applications can handle downtime and which require active replicas.
Iran’s claims still await independent verification. But even without proof of total destruction, confirmed attacks since March already show that cloud infrastructure is no longer a secondary element in conflict and might become a direct military target.
Frequently Asked Questions
Has Amazon confirmed the destruction of its Bahrain data center?
No. The IRGC claims the infrastructure was destroyed, but AWS had not publicly confirmed that as of this writing.
Have there been previous attacks on the AWS region in Bahrain?
Yes. Amazon confirmed physical damage to its Bahrain data centers during the drone attacks in March 2026 and warned that full recovery could take several months.
Can an application continue operating if an AWS region fails?
It depends on its design. To remain operational, it needs replicas, recoverable copies, and proven procedures in another region or provider. High availability within a single region does not always protect against prolonged total loss of that location.
Are other Gulf data centers at risk?
Iran has publicly indicated U.S. infrastructure in several regional countries. While this doesn’t confirm future attacks, it increases geopolitical risks that operators and clients should consider.
via: house of saud
