AWS Says Iran Strikes Caused Permanent Customer Data Loss
The disclosure marks a hard limit for AWS’s regional protections after damage reached multiple availability zones.
Loading page…
The disclosure marks a hard limit for AWS’s regional protections after damage reached multiple availability zones.
Listen to this story
AWS has confirmed that attacks on its Bahrain and UAE infrastructure caused permanent customer-data loss, exposing limits in its regional redundancy model. One UAE availability zone suffered irretrievable loss, while damage across all three Bahrain zones left resources inaccessible and exceeded what AWS’s multi-Availability Zone services were designed to withstand. AWS is still replacing infrastructure in the UAE, but has no Bahrain restoration timetable beyond an early-2027 support update.
AWS identified three strikes: Iranian drones hit facilities in Bahrain and the UAE, followed by a Bahrain strike and missile attack.
The UAE loss is confined to mec1-az2; AWS is still working on the other two availability zones.
AWS reportedly issued $150 million in customer credits after the March attacks and suspended billing in both regions.
AWS says Iranian strikes on data centers in Bahrain and the United Arab Emirates left some customer resources and data permanently inaccessible. In the UAE, data was irretrievably lost in one availability zone; in Bahrain, AWS said it could not restore access to resources and data across all three zones in the region.
The acknowledgment came in an AWS dashboard update on September 15, about six months after the first attacks. AWS had suspended billing in the affected Bahrain and UAE regions while attempting to restore normal operations.
The lost UAE data was in mec1-az2, one of the region’s three availability zones. AWS is still working to recover regional resources and restore services in the other two UAE zones, and said it is replacing affected infrastructure over the coming months.
AWS described the Bahrain damage as spanning multiple availability zones and exceeding what its regional and multi-Availability Zone services were designed to withstand. Its statement identifies physical damage across several zones as the condition that surpassed those service limits.
After the initial strikes, AWS urged customers to move resources to other cloud regions and use remote backups for inaccessible resources. It reportedly issued $150 million in customer credits after the March strikes.
The loss turns AWS’s earlier recovery guidance into the practical dividing line for affected workloads: migrate to another region where possible, and use remote backups for resources that became inaccessible. AWS has not offered a timetable for restoring Bahrain services beyond its promised early-2027 customer update.
Editorial analysis
AWS’s disclosure puts a concrete boundary around the protection its regional and multi-Availability Zone services can provide. The company says damage across multiple zones exceeded those services’ design limits, while its post-strike guidance directed customers toward remote backups and migration to other regions. That does not establish which individual recovery plans succeeded. But it makes the Bahrain update AWS has promised for early 2027 more consequential: it should show whether replacing affected infrastructure can restore any remaining regional resources after the losses AWS has already deemed irretrievable.
Loading discussion...
Join the conversation
Explain what protection you would expect from a cloud provider.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.