When Iranian drones hit 3 Amazon Web Services data centres in the UAE and Bahrain, millions lost access to basic digital services overnight.
The Guardian reports: In the early hours of March 1st, an Iranian Shahed 136 drone struck an Amazon Web Services (AWS) data centre in the United Arab Emirates. The attack — believed to be the first deliberate targeting of a commercial data centre by the armed forces of a nation at war — set off a fire that forced a shutdown of the facility’s power supply. Further damage followed as crews attempted to suppress the flames with water.
Within hours, a second AWS facility in the UAE was hit. Then a third data centre, this time in Bahrain, was struck when an Iranian suicide drone exploded on nearby ground.
Iranian state television reported that the Islamic Revolutionary Guard Corps launched the strikes to examine the role of these centres in supporting what it described as “the enemy’s military and intelligence activities.” The statement pointed toward a deliberate calculation: that commercial cloud infrastructure, woven into both civilian life and military logistics, now constitutes a legitimate military target.
The consequences for ordinary life were immediate. Millions of residents in Dubai and Abu Dhabi woke the following morning unable to pay for transport, order food, or access their bank accounts through mobile applications. In a region where nine out of ten UAE residents are foreign nationals — deeply dependent on digital services for everything from remittances to daily commerce — the disruption landed with particular force.
The AWS network, built by Jeff Bezos’s company into one of the world’s dominant cloud providers, is engineered to absorb the loss of a single regional node. The coordinated nature of the strikes, however, overwhelmed that resilience. Taking two UAE facilities offline in close succession, followed by disruption in Bahrain, was enough to collapse service across a wide swath of the Gulf.
The military rationale behind targeting AWS is not arbitrary. Cloud infrastructure in the Gulf region does not only serve consumers checking bank balances or hailing taxis. It underpins logistics systems, communications networks, and, in some cases, intelligence operations. By striking facilities shared between civilian and potentially military users, Iran appears to have chosen a form of pressure that blurs the line between economic coercion and direct military action — and does so in a way that makes attribution and proportionate response legally and politically complicated for its adversaries.
What makes this episode significant beyond its immediate disruption is the precedent it sets. Commercial data centres have long existed in a grey zone of international humanitarian law, which distinguishes between civilian objects and military objectives. The IRGC’s stated justification — investigating the centres’ role in supporting enemy operations — is precisely the kind of dual-use framing that could be applied to almost any piece of critical digital infrastructure.
Whether the strikes achieved any meaningful military effect remains unclear. But their political and symbolic impact was considerable. Iran has signalled, with considerable precision, that it can reach into the economic infrastructure of Gulf states aligned with its adversaries, and that it is willing to do so in ways that affect millions of civilians while maintaining plausible military justification.
For governments and corporations operating cloud infrastructure in contested regions, the attack will force a reckoning with assumptions that have long underpinned data centre siting decisions. Physical security, geographic dispersal, and legal exposure will all need reassessment. So too will the relationship between commercial cloud providers and the militaries that increasingly rely on their services — a relationship that, until now, has rarely been tested at the end of a drone.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de