- AWS says data stored exclusively in its Bahrain region and one UAE availability zone cannot be recovered following extensive physical damage.
- Damage across multiple availability zones exceeded the disruption AWS’s regional and multi-AZ architecture was designed to withstand.
- The incident highlights the need for security and resilience strategies to consider the geographic location and physical independence of cloud backups and replicated workloads.
The company said it was unable to restore access to resources and data stored exclusively in the Middle East (Bahrain) region, while data held solely in one of the three availability zones in its UAE region, identified as mec1-az2, is also unrecoverable. The confirmation was issued through the AWS Health Dashboard on 15 September.
The incident is significant for security and resilience teams because the damage extended beyond the failure of an individual facility. AWS said the impact across multiple availability zones exceeded the level of disruption its regional and multi-availability-zone services are designed to withstand.
AWS availability zones are designed to provide physical separation within a region, allowing workloads to be distributed so that the failure of one location does not necessarily take down an entire application or service. The events in Bahrain and the UAE demonstrate the limits of that model when multiple sites within a geographic region are simultaneously affected.
The infrastructure was damaged during drone and missile strikes in March amid the conflict involving Iran and regional targets. AWS subsequently advised customers to move workloads from the affected infrastructure to other regions. A further disruption in Bahrain later affected the wider region, while AWS continued recovery efforts in the UAE.
For organisations that had replicated data and workloads across regions, the consequences were different from those relying exclusively on the affected infrastructure. AWS has said it is continuing to work with customers affected by the disruption, while recovery and replacement work continues in the UAE.
The incident therefore raises questions about how organisations define redundancy. Having multiple availability zones does not necessarily provide protection against a sufficiently broad physical event if those zones remain within the same geographic region.
That has implications beyond cloud architecture. Security teams responsible for critical systems increasingly need to consider physical threats to digital infrastructure alongside conventional cyber risks, including the potential impact of conflict, targeted attacks, prolonged power disruption and damage to supporting infrastructure.
For organisations operating in the Middle East, the AWS incident provides a real-world example of why resilience planning needs to consider not only whether data is backed up, but where that backup is physically located, how independently it can operate and what circumstances the redundancy strategy is designed to withstand.
AWS has said it will provide a further update on the Bahrain region in early 2027, while work continues to replace affected infrastructure in the UAE.
