AWS Just Said Some Customer Data Is Gone Permanently. Read Your DR Plan Again.

Cloud disaster recovery planning generally assumes the failure modes are hardware faults, human error, and software bugs. In two updates posted September 15, AWS confirmed a failure mode most DR documents don’t account for: the building isn’t there anymore, and the data in it is not coming back.

What AWS actually said

Six months after drone strikes damaged its Middle East infrastructure, AWS acknowledged permanent loss of customer data in Bahrain and the UAE.

For Bahrain (me-south-1), AWS said it is unable to restore access to resources and data hosted exclusively in that region — adding that the damage spanned multiple availability zones and exceeded what its regional and multi-AZ services are designed to withstand. AWS said it will share a further update in early 2027.

For the UAE (me-central-1), the loss is contained to one availability zone. AWS said it is unable to restore access to resources and data hosted exclusively in mec1-az2, one of three zones, while work continues on mec1-az1, mec1-az3, and shared regional infrastructure.

The company said most customers in both regions had already relocated before the losses became permanent, using backups where available or implementing alternative solutions.

The sentence worth reading twice

“Exceeded what our regional and multi-AZ services are designed to withstand.”

Multi-AZ is the standard answer to “what if a data center fails.” It’s what you deploy when you want resilience without the cost and complexity of multi-region. The entire premise is that availability zones are independent enough that one failing doesn’t take the others with it — which is true for the failure modes AZ separation was designed around: power, cooling, network, fire in a single facility.

It is not true for a threat that targets multiple facilities in the same metro deliberately. The strikes in March hit two UAE facilities directly and damaged a Bahrain site through a nearby explosion, knocking two of me-central-1’s three availability zones offline and triggering outages across EC2, S3, DynamoDB, Lambda, RDS, and other core services. Fires, power cuts, and water damage from fire suppression compounded it. Fresh strikes hit Bahrain again in April.

Multi-AZ did what it was designed to do. The threat was simply outside its design envelope.

What this cost real companies

The March outage disrupted Careem, payments firms Hubpay and Alaan, Snowflake, and several major UAE banks including Emirates NBD, First Abu Dhabi Bank, and Abu Dhabi Commercial Bank. Iran’s Islamic Revolutionary Guard Corps claimed responsibility and said it targeted the Bahrain facility because AWS hosts US military workloads there.

Uptime Institute characterized it as the first confirmed military attack on a hyperscale cloud provider. That framing matters for planning purposes: this is now a documented precedent, not a hypothetical in a risk register.

What to actually change in your DR plan

The lesson isn’t “don’t use the cloud” or “AWS failed.” AWS told customers to migrate in March and most did. The lesson is narrower and more actionable:

• Know what exists exclusively in one region. That word is doing all the work in AWS’s statement. Data with a copy elsewhere was recoverable. Data held only in Bahrain was not. Audit for anything — backups included — that lives in exactly one region.
• Multi-AZ is not a substitute for multi-region for correlated threats. Geographic correlation is the variable that matters. Two AZs in the same metro share a threat surface that two regions on different continents don’t.
• Check whether your backups are in the same region as your primary. This is an extremely common configuration, it’s cheaper, it has lower latency, and it fails completely in exactly this scenario.
• Test restoring from your cross-region copy, not just verifying it exists. A backup you’ve never restored from is a hypothesis.
• Factor geopolitical exposure into region selection. Proximity to a military base, or a region in a state hosting foreign forces, is now a legitimate input to an architecture decision. That felt paranoid a year ago. It doesn’t now.

The uncomfortable broader point

AWS has not given a restoration date for the UAE and expects to provide another Bahrain update in early 2027. Some customers are effectively being told to rebuild elsewhere.

The cloud’s core value proposition includes durability guarantees that are, in normal operation, far better than anything most organizations achieve on their own hardware. That remains true. But durability guarantees are contractual and probabilistic, not physical — and they’re written against a threat model. When reality exceeds the threat model, the guarantee doesn’t hold, and the recourse is a service credit rather than your data.

Meanwhile, the IRGC in the spring named Microsoft, Oracle, Alphabet, and Nvidia among American tech companies it accused of contributing to attacks on Iran, and some tech companies are proceeding with Gulf data-center projects regardless. Whether that’s confidence or momentum is a judgment call worth making deliberately if you’re choosing where to put production workloads.

Official reference: AWS Health Dashboard updates posted September 15, 2026, with reporting from CNBC, Data Center Dynamics, and Help Net Security. The March incident timeline draws on AWS’s own health dashboard posts from March 1-2 and Uptime Institute analysis.