AWS cannot restore access to Bahrain region or one UAE zone after strikes

Why it matters

AWS recommends cross-region recovery for events that disable an entire region. Its inability to restore resources held exclusively in Bahrain gives cloud customers and Gulf AI projects a concrete case for testing geographic recovery beyond one region.

Amazon Web Services said on September 15th that it cannot restore access to resources and data held exclusively in its Bahrain region, six months after drone strikes damaged cloud facilities across Bahrain and the United Arab Emirates. AWS also cannot recover resources stored in one UAE availability zone, while work continues on two other affected zones, according to CNBC's report.

AWS said the Bahrain damage spanned multiple availability zones and "exceeded what our regional and multi-AZ services are designed to withstand." The September update on the AWS health dashboard was its first public account of the recovery effort since April.

Matt Garman runs the cloud division he joined in 2006, helped build its early services and became AWS CEO in June 2024. Garman took over the division built by Amazon CEO Andy Jassy, who founded and led AWS from its inception. Their original product thesis turned storage and computing capacity into services that developers could rent without building data centers of their own. The March attacks exposed the physical boundary beneath that abstraction.

A regional failure across several facilities

AWS said when it launched its Bahrain region in July 2019 that the region had three availability zones. AWS also described a three-zone structure when its UAE region opened in August 2022.

AWS describes an availability zone as one or more discrete data centers within a region. Its documentation lists three zones in Bahrain and three in the UAE.

That structure is designed to contain localized equipment failures, power problems and natural disasters. The March attacks reached several facilities in the same geographic area. Two UAE data centers were directly struck, while a nearby strike damaged infrastructure in Bahrain. AWS reported structural damage, power disruption and additional water damage caused by fire-suppression work, according to The Associated Press.

AWS told Bahrain customers to move workloads into other regions after the facilities were damaged. For resources that remained, AWS used backups where available and tried alternative recovery methods. AWS said it had exhausted its options for resources and data hosted exclusively in the Bahrain region, according to its account of the conflict's impact.

The result draws a hard line between high availability and disaster recovery. Deploying across several zones can keep an application running through many local failures. AWS recommends cross-region recovery for an event that disables an entire region, while its resiliency guidance places configuration of backups, replication and multi-zone deployment with customers. Data-residency rules can limit where some organizations are allowed to keep copies.

Garman inherits a test of the cloud contract

Garman's job now extends beyond replacing servers and damaged buildings. AWS has to preserve customer confidence in the division's central bargain: customers hand over responsibility for physical infrastructure, while retaining responsibility for how applications and data are distributed across that infrastructure.

The distinction can be clear in architecture diagrams and much harder in practice. Cross-region systems add costs, operational work and data-governance questions. A startup may reasonably decide that running duplicate infrastructure elsewhere is excessive for an unlikely regional event. Banks, governments and other regulated customers may require local storage, leaving fewer options for geographic separation.

AWS has not attached a customer count, data volume or financial estimate to the damage. AWS said it continues recovery work on two affected UAE zones and expects to issue a Bahrain update in early 2027.

The scale of the loss remains undisclosed. Amazon reported $128.7 billion in AWS sales and $45.6 billion in AWS operating income for 2025, compared with $80 billion in operating income across Amazon. A localized outage will not threaten those numbers on its own. An acknowledged inability to recover customer resources carries a broader trust cost for a business built on making infrastructure risk somebody else's problem.

Gulf AI campuses face the same physical constraint

OpenAI announced Stargate UAE in May 2025 with G42, Oracle, Nvidia, Cisco and SoftBank. OpenAI described an initial 1-gigawatt Abu Dhabi cluster, with 200 megawatts expected to begin operating in 2026. CNBC described the broader UAE-US AI campus as a 5-gigawatt development covering 10 square miles.

Reuters reported on September 11th that UAE officials were considering dispersing facilities across the country and adding underground construction, blast-resistant concrete, and drone and missile defenses. Those measures carry a different cost structure from the familiar data-center checklist of land, power, water, chips and network capacity.

AWS's experience gives those deliberations a concrete failure case. Closely connected facilities reduce latency and make routine failover practical. Geographic concentration also leaves several zones exposed to the same conflict. The next generation of cloud and AI campuses in the Gulf will need security planning that includes military damage among its infrastructure scenarios.

For AWS customers, the September 15th update turns a rare event into an architecture requirement that can be priced and tested. Multi-zone deployment remains the baseline for ordinary failures. Workloads that cannot tolerate regional loss need recoverable copies elsewhere, along with regular proof that those copies can take over. Six months after the strikes, AWS's update documents the outcome for resources whose recovery plan ended at the regional boundary.