AWS Data Centers Hit by Iranian Drone Strikes: Cloud Risks Investors Must Consider

On March 1, 2026, Iranian drones struck three Amazon Web Services (AWS) data centers in the United Arab Emirates and Bahrain. The Islamic Revolutionary Guards Corps (IRGC) officially claimed responsibility for the attacks, citing the data centers' role in supporting U.S. military and intelligence networks. This marked the first publicly confirmed military attack on a hyperscale cloud provider's infrastructure.

Two availability zones in the UAE offline simultaneously

The drone strikes hit two availability zones in the AWS ME-CENTRAL-1 region (UAE) and one zone in the ME-SOUTH-1 region (Bahrain). On March 5, 2026, AWS confirmed structural damage to facilities, power outages, fire damage, and water damage from activated fire suppression systems. The simultaneous failure of multiple zones proved critical: cloud providers' standard redundancy models are designed for single-zone failures—the concurrent failure of two zones in one region and another in Bahrain overwhelmed failover systems.

By late April 2026, more than a month after the attacks, AWS service dashboards still showed "disrupted" status for affected services in the regions. AWS warned of extended recovery times.

Financial services firms and international companies affected

Affected companies included Abu Dhabi Commercial Bank, Emirates NBD, First Abu Dhabi Bank, and payment platforms Hubpay and Alaan. Data cloud company Snowflake and mobility platform Careem also reported outages. Many affected firms had no intentional presence in the Middle East—their cloud workloads were automatically routed through the region, unknown to them until the disruptions occurred.

Iranian state media described the AWS facilities as legitimate targets because the U.S. military uses AI systems on AWS—specifically naming Anthropic's Claude for intelligence analysis and war simulations. Iran claimed to have also attacked Microsoft facilities; Microsoft officially denied this, reporting neither hits nor outages.

Geopolitical risk cannot be designed away

Sam Winter-Levy, fellow at the Carnegie Endowment, stated on March 20, 2026, that such physical attacks would become more frequent as AI infrastructure grew in importance. Winter-Levy had already warned in July 2025 in an opinion piece in the Washington Post against building critical computing infrastructure in the Gulf region, citing growing tensions between the U.S. and Iran.

Analysts note that as economies increasingly depend on cloud services, data centers are becoming attractive targets in asymmetric conflicts. The March 1, 2026, attacks showed that cloud providers cannot technically eliminate geopolitical risks through redundancy and failover systems alone.

Industry calls for military-grade protection for data centers

Following the attacks, the tech industry raised the question of whether data centers should be defended like military facilities. Ashish Nadkarni, who leads global infrastructure research at IDC, stated on March 20, 2026, that data center protection is now comparable to protecting government buildings with the highest security levels.

IDC reported that damage to AWS infrastructure would drive increased investment in data infrastructure as companies sought to diversify data storage. In the Middle East, cloud providers are increasingly adopting "Multi-AZ" deployments—data copies stored in separate data centers. Globally, companies and governments expect data center operators to provide recovery plans and multiple sites within a single country.

Underground bunkers as new security strategy

Data storage providers worldwide began building underground facilities in former Cold War nuclear bunkers, caves, and mountains to attract security-conscious customers. Facilities in the United Kingdom are described as capable of withstanding nuclear explosions.

Gulf states have committed trillion-dollar investments in AI data infrastructure. To win customers, these governments must now offer enhanced security measures. The March 1, 2026, attacks create competitive pressure for regional data center operators to differentiate through increased physical security.

What investors should consider with cloud stocks

The incidents raise new questions for investors. Cloud infrastructure was considered geographically diversified and thus resilient—the simultaneous failures of multiple availability zones demonstrate the limits of this assumption. Google, Microsoft, and Oracle also operate data centers in the region and are thus positioned in an active conflict zone, creating concentrated risk.

The attacks represent an unprecedented scenario: targeted military strikes against commercial cloud infrastructure as a wartime objective. Few legal precedents or frameworks exist to govern military attacks on civilian infrastructure in this context.

For investors in cloud and tech stocks, this means: geopolitical risks must be weighted more heavily in evaluating hyperscale cloud providers. Companies with diversified geographic infrastructure, clear recovery plans, and investments in physical security are likely better positioned against such scenarios. The question of whether war damage to data centers is insurable and how liability risks are divided between cloud providers and customers remains unresolved.