AWS has written off the customer data that lived only in its Bahrain region
Six months after strikes damaged facilities in Bahrain and the UAE, AWS says resources held only in Bahrain cannot be restored. Its resiliency guidance leaves cross-region copies to the customer to configure.
The Engineer · Build desk
What happened
- AWS said on September 15th that it cannot restore access to resources and data held exclusively in its Bahrain region, six months after drone strikes damaged cloud facilities in Bahrain and the UAE.
- In the UAE region, AWS has restored access to the mec1-az2 availability zone and still cannot reach the az1 and az3 zones, according to The Stack.
- AWS told Bahrain customers to move workloads to other regions, then used backups where they existed and tried alternative recovery methods before saying it had exhausted its options.
- The company has not attached a customer count, a data volume or a financial estimate to the damage.
- AWS says recovery work continues on two affected UAE zones and that it expects to issue its next public update on Bahrain in early 2027.
Why it matters
- What it limits constraint A bank or government tenant held to in-country storage cannot take AWS's cross-region advice without breaking the residency rule, so choosing one region is also accepting that a region-wide event is a total loss.
- Who's exposed exposure Because the resiliency guidance assigns backups, replication and multi-zone deployment to the customer, the unrecoverable data sits on the tenant's books, not the provider's.
- Who has to decide decision Anyone whose only copy sits in a single region now has a dated case to put in front of the budget owner who ruled cross-region duplication excessive.
- What doesn't add up contradiction The two published accounts of the UAE do not agree: the CNBC-based report has one zone unrecoverable with work continuing on two others, while The Stack has one zone back and two unreachable, so a UAE tenant cannot tell from the record which case applies to its zone.
Next story · Build · Sep 20
AWS says the damage in Bahrain outran what multi-AZ was designed to absorbConfirmed2 publishers
An availability zone, in AWS's own documentation, is one or more discrete data centers inside a region, and that documentation lists three zones in Bahrain and three in the UAE [12]. The structure exists to contain localized equipment failures, power problems and natural disasters [13]. What hit it was several facilities in one geographic area: two UAE data centers struck directly, and a nearby strike that damaged infrastructure in Bahrain [6]. Structural damage and power disruption followed, along with water damage caused by fire-suppression work, according to the Associated Press [7]. The Stack described the attacks as Iranian strikes [4].
"The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand," AWS said in its Bahrain update [8]. Multi-AZ deployment buys uptime through the loss of a data center. The loss of a metropolitan area is past what it covers. For an event that disables an entire region AWS recommends cross-region recovery, and its resiliency guidance leaves backups, replication and multi-zone deployment for the customer to configure [14].
Some customers moved data out of Bahrain after the March attacks, and a second disruption in April took the region out entirely; The Stack wrote that customers who moved slowly are out of luck [3]. The gap between the two events was a matter of weeks [18]. A plan whose first step is to copy the estate elsewhere once the notice arrives has to run at full data volume over a damaged region's remaining capacity, while every other tenant is trying to do the same thing.
The Bahrain region opened in July 2019 with three availability zones, and the UAE region in August 2022 with three [17]. Cross-region copies add cost, operational work and data-governance questions, and a startup can reasonably decide duplicate infrastructure elsewhere is excessive for an unlikely regional event [10]. Regulated tenants have the reverse problem: banks, governments and others may be required to keep data locally, which leaves fewer options for geographic separation [9]. For those customers the cross-region recommendation and the residency rule cannot both be satisfied inside one country's footprint.
Amazon reported $128.7 billion in AWS sales and $45.6 billion in AWS operating income for 2025, against $80 billion in operating income across Amazon [15], so roughly 57 percent of the company's operating income came from the cloud division [19]. A regional loss of undisclosed size does not move that. The September post was AWS's first public account of the recovery effort since April, about five months earlier [16][20].
What to watch
- Whether the early 2027 Bahrain update revises the unable-to-restore finding or finally attaches a data volume to it.
- Whether az1 and az3 in the UAE are restored or join Bahrain in the unrecoverable column.
- Whether any regulated Gulf customer discloses a loss, and whether in-country-only residency rules are revisited as a result.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives50
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 42%
- Investor
- Investor 28%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Amazon Web Services said on September 15th that it cannot restore access to resources and data held exclusively in its Bahrain region, six months after drone strikes damaged cloud facilities across Bahrain and the United Arab Emirates.
- [2]
AWS told Bahrain customers to move workloads into other regions after the facilities were damaged; for resources that remained it used backups where available and tried alternative recovery methods, and said it had exhausted its options for resources and data hosted exclusively in the Bahrain region.
- [3]
Some customers were able to move data out of Bahrain following the March attacks, but a second "disruption" in April knocked out the region entirely, and The Stack wrote that customers who moved slowly are out of luck.
- [4]
The Stack reported that Iranian strikes took out two of AWS's Middle East cloud infrastructure regions nearly six months before AWS confirmed on Tuesday that it is unable to regain access to several availability zones.
- [5]
AWS said it continues recovery work on two affected UAE zones and expects to issue a Bahrain update in early 2027.
- [6]
The March attacks reached several facilities in the same geographic area: two UAE data centers were directly struck, while a nearby strike damaged infrastructure in Bahrain.
- [7]
AWS reported structural damage, power disruption and additional water damage caused by fire-suppression work, according to The Associated Press.
- [8]
"The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand," AWS said in the update for the Bahrain region.
- [9]
Data-residency rules can limit where some organizations are allowed to keep copies; banks, governments and other regulated customers may require local storage, leaving fewer options for geographic separation.
- [10]
Cross-region systems add costs, operational work and data-governance questions, and a startup may reasonably decide that running duplicate infrastructure elsewhere is excessive for an unlikely regional event.
- [11]
AWS has not attached a customer count, data volume or financial estimate to the damage.
- [12]
AWS describes an availability zone as one or more discrete data centers within a region, and its documentation lists three zones in Bahrain and three in the UAE.
- [13]
The availability-zone structure is designed to contain localized equipment failures, power problems and natural disasters.
- [14]
AWS recommends cross-region recovery for an event that disables an entire region, while its resiliency guidance places configuration of backups, replication and multi-zone deployment with customers.
- [15]
Amazon reported $128.7 billion in AWS sales and $45.6 billion in AWS operating income for 2025, compared with $80 billion in operating income across Amazon.
- [16]
The September update on the AWS health dashboard was its first public account of the recovery effort since April.
- [17]
AWS said when it launched its Bahrain region in July 2019 that the region had three availability zones, and it described a three-zone structure when its UAE region opened in August 2022.
- [18]
The interval between the March attacks and the April disruption that took the Bahrain region out entirely was a matter of weeks.
- [19]
AWS operating income was about 57 percent of Amazon's total operating income in 2025.
- [20]
About five months separated AWS's April account of the recovery and its September 15th update.
- [21]
AWS has been able to restore access to the mec1-az2 availability zone in the UAE region, but is still unable to access the az1 and az3 zones in that region.
- [22]
According to CNBC's report, AWS cannot recover resources stored in one UAE availability zone, while work continues on two other affected zones.
Sources
3 independent publishers whose own reporting we read for this story.
- runtimewire.comAWS cannot restore access to Bahrain region or one UAE zone after strikes
1 article · September 15, 2026
- thestack.technologyAWS: Cloud instances in Bahrain, UAE might be lost for good
1 article · September 15, 2026
- tomshardware.comAWS tells clients to abandon Middle East data centers six months after Iranian drone strikes — Amazon offers no recovery timeline as UAE mulls underground data centers
1 article · September 16, 2026
Topics and entities
Topics
- Data-center physical security
- Gulf AI infrastructure buildout
- Cloud disaster recovery
- Data Residency and Inference Geography