AWS Unable to Restore Bahrain Cloud Region After War Damage

Key Takeaways

• Bahrain Recovery Exhausted: AWS said it has exhausted its options for restoring data and resources that were not migrated before its Bahrain region became unavailable.
• Damage Exceeded Regional Safeguards: AWS said physical damage in Bahrain spanned multiple availability zones and exceeded what its regional and multi-AZ services were designed to withstand.
• One UAE Zone Remains Inaccessible: AWS cannot restore access to resources and data hosted exclusively in the UAE availability zone known as mec1-az2, though recovery work continues elsewhere in the region.
• War Exposed Infrastructure Vulnerabilities: AWS facilities were damaged during Iranian retaliation following U.S. and Israeli attacks on Iran, with the resulting outages affecting some banking operations, Reuters previously reported.
• UAE Reconsidering Data-Center Resilience: Reuters reported that the UAE is revising plans for a major AI data-center project, including consideration of dispersed, underground and blast-resistant infrastructure.

Deep Dive

Amazon Web Services has spent months trying to recover cloud infrastructure damaged during the war with Iran. In Bahrain, it has reached the end of that effort. AWS cannot restore access to its Bahrain cloud region or to resources and data held exclusively in one of its three availability zones in the United Arab Emirates, according to a company status update seen by Reuters. Reuters first reported the development Tuesday.

The failure in Bahrain was not confined to a single facility or availability zone, the kind of disruption AWS's regional architecture is built to contain. The physical damage spread further.

“The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand,” AWS said in the update.

Availability zones are clusters of one or more data centers within the same geographic region, separated so that a problem in one does not necessarily bring down workloads running elsewhere. In Bahrain, the damage ultimately crossed those boundaries.

AWS said it has assessed all of the affected infrastructure there and exhausted its options for restoring data and resources that had not been moved before the region became unavailable. The company has instead been helping Bahrain-based customers re-establish operations in other regions, drawing on backups where they exist and implementing alternative solutions where data remains inaccessible.

That process had begun well before AWS concluded that recovery was no longer possible. After the first Bahrain availability zone was damaged in March, the company began recommending that customers migrate their workloads to other regions. Most did so before disruption to a second availability zone in April took the Bahrain region offline, AWS said in Tuesday's update.

The situation in the UAE is less absolute, although some losses appear similarly beyond recovery. AWS said it cannot restore access to resources and data hosted exclusively in one availability zone, known as mec1-az2. It continues to work on recovering resources elsewhere in the UAE region and across the other two affected zones.

The company is replacing damaged infrastructure in the UAE and expects to provide another update on service restoration in the coming months. A further update on Bahrain operations is expected in early 2027. AWS said it has notified the relevant authorities in both countries and continues to work with them.

The damage dates to the fighting that followed U.S. and Israeli attacks on Iran in March. Tehran retaliated with missile and drone strikes against Israel and Gulf states hosting U.S. military bases.

AWS said at the time that two of its facilities in the UAE had been directly struck. In Bahrain, a drone strike near one of its facilities physically damaged AWS infrastructure. The consequences were not confined to cloud customers. Some banking operations were affected by the AWS outages, Reuters previously reported, citing a person familiar with the situation.

What happened in Bahrain is particularly significant because the damage exceeded the resilience AWS says its regional and multi-availability-zone services were designed to withstand. Redundancy can protect against a failed data center, a power interruption or other localized disruption. The calculation becomes harder when physical destruction reaches several supposedly separate parts of the same regional architecture.

That problem is no longer theoretical for governments and companies pouring money into cloud and artificial-intelligence infrastructure across the Gulf. The UAE is already reconsidering how some of that infrastructure should be built. Reuters reported last week that the country is revising plans for a major AI data-center project following the Iranian attacks, including consideration of dispersing facilities rather than concentrating them and using underground and blast-resistant infrastructure.

For AWS customers in Bahrain, those longer-term questions follow a more immediate conclusion. The company said it has exhausted every available option for recovering resources that were not migrated before the region went down. Customers whose operations could be rebuilt elsewhere have been supported in doing so. Data that existed only on infrastructure AWS can no longer recover remains inaccessible.

AWS said it remains committed to supporting customers in both Bahrain and the UAE.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.