The War Came for the Cloud: Iranian Drones Hit AWS Data Centers and the Gulf Tech Dream

Iranian drones struck three Amazon Web Services data centers across the UAE and Bahrain on Sunday, marking the first time a major U.S. technology company’s cloud infrastructure has been knocked offline by military action. The strikes — part of Tehran’s broader retaliatory campaign after U.S.-Israeli forces killed Supreme Leader Ayatollah Ali Khamenei — caused structural damage, triggered fire suppression systems that flooded server rooms with water, and severed power to critical infrastructure serving millions of customers across the Gulf.

Banking apps went dark. Payment platforms froze. Enterprise software ground to a halt. And the pitch that Gulf monarchies have been making to Silicon Valley for half a decade — that the desert is a safe, stable home for the world’s data — collapsed in a matter of hours.

The fallout extends far beyond the UAE. In Saudi Arabia, where Crown Prince Mohammed bin Salman has staked billions on transforming the Kingdom into a global technology hub under Vision 2030, the drone strikes have forced an uncomfortable reckoning: if AWS facilities in the UAE are not safe from $35,000 Shahed drones, what does that mean for the $5.3 billion AWS is investing in Saudi data centers scheduled to go live this year?

What Happened to the AWS Data Centers?

Amazon confirmed on Monday that two of its facilities in the United Arab Emirates were “directly struck” by drones, while a third facility in Bahrain suffered damage from a drone strike in close proximity to the site. The company described the damage in measured corporate language that could not disguise the severity: structural impacts, power disruption, and fire suppression activation that caused additional water damage to equipment.

A dozen core AWS cloud services were disrupted across the Middle East (Bahrain) region, known internally as me-south-1, and the UAE region. Amazon advised customers to back up critical data immediately and reroute operations to servers in unaffected regions — a process that is neither fast nor cheap for companies that chose Gulf data centers specifically for low-latency access to regional customers.

The strikes occurred during a 72-hour barrage in which Iran launched waves of drones and missiles at Gulf states. The UAE Ministry of Defense reported that its air force and air defense systems engaged 541 drones, 165 ballistic missiles, and 2 cruise missiles since the Iranian attack began on February 28. Of those 541 drones, 35 penetrated the country’s air defenses. Twenty-one struck civilian targets. Three people were killed and 58 injured.

Data centers, it turns out, are soft targets. They do not move. They do not shoot back. And unlike oil refineries, which have been hardened against aerial threats since the 2019 Abqaiq-Khurais attacks, cloud computing facilities were built on the assumption that the missiles would never reach them.

Which Services Went Down?

The outage cascaded through the Gulf’s digital economy with the speed and indifference of falling dominoes. Financial institutions were hit first and hardest.

Emirates NBD, one of the largest banking groups in the Middle East, confirmed its platforms and mobile application went down due to what it called a “region-wide IT disruption.” Abu Dhabi Commercial Bank (ADCB) reported similar failures. For millions of customers across the UAE, the inability to access bank accounts during an active military conflict compounded an already volatile situation.

Payment and fintech companies followed. Alaan, the UAE-based corporate spend management platform, and Hubpay, a digital payments provider, both reported outages tied directly to AWS infrastructure failures. Careem, the ride-hailing and delivery platform owned by Uber that serves millions across the Middle East, experienced service disruptions.

On the enterprise side, Snowflake, the cloud data platform used by corporations for analytics and data warehousing, reported service disruptions affecting customers with workloads running on the affected AWS regions. The ripple effects are still being catalogued.

AWS has said it expects recovery to be “prolonged” given the nature of the physical damage involved. That single word — prolonged — carries enormous weight for companies whose entire operations depend on Gulf-hosted cloud infrastructure.

Is This the End of the Gulf’s Safe AI Promise?

Less than a year ago, the Gulf was being celebrated as the next great frontier for artificial intelligence. President Trump’s four-day tour of Saudi Arabia, Qatar, and the UAE in May 2025 produced more than $2.2 trillion in investment pledges, with technology and AI at the center of nearly every deal. Saudi Arabia committed $600 billion over four years. The UAE pledged $1.4 trillion over a decade. Nvidia shipped 18,000 of its advanced Blackwell chips to Humain, the AI startup backed by Saudi Arabia’s Public Investment Fund.

Microsoft announced it would grow its total UAE investment to $15 billion by 2029, deploying Nvidia chips in data centers there. Oracle expanded its Saudi footprint with a $1.5 billion cloud investment. Google Cloud established its Saudi Arabia region in Dammam. The message was clear: the Gulf was open for business, and the world’s most valuable companies were rushing in.

Rest of World put the question bluntly in a piece published Monday: for years, Gulf leaders made a simple promise to Silicon Valley — stability for their data, models, and chips. On Sunday, that promise burned.

The timing is particularly damaging. Microsoft confirmed just last month that its Saudi Arabia East datacenter region, located in the Eastern Province and comprising three availability zones, would be available for customers to run cloud workloads from Q4 2026. That announcement now reads differently when the Eastern Province sits within drone range of Iranian-aligned forces.

What Does This Mean for Saudi Arabia’s Cloud Ambitions?

The Kingdom’s cloud and data center market is valued at $2.1 billion and growing at a 29 percent compound annual rate through 2030, according to recent market analysis. The sector is projected to reach $3.9 billion by 2030. These projections were built on assumptions that no longer hold.

Consider the scale of what is under construction or recently operational in Saudi Arabia:

AWS is investing $5.3 billion to build a new Saudi Arabia cloud region with three Availability Zones, scheduled to launch in 2026. Microsoft is building three data centers in the Eastern Province for its Azure cloud platform, also set to open in 2026. Oracle operates cloud regions in both Jeddah (launched 2020) and Riyadh (launched 2024), with $1.5 billion committed to further expansion. Google Cloud established its Dammam region in 2023 with plans for additional locations.

The Saudi Data and AI Authority (SDAIA), which reports directly to the Prime Minister and serves as the national steward of the Kingdom’s AI agenda, announced in January 2026 that a Tier IV data center facility — the highest classification from the global Uptime Institute — was under development in Riyadh. SDAIA President Dr. Abdullah bin Sharaf Alghamdi described the Hexagon Data Center as a strategic national initiative reinforcing Saudi Arabia’s ambition to become one of the world’s leading data-driven economies.

None of these facilities were designed to withstand the kind of attack that hit the UAE on Sunday. The question confronting MBS and his planners is whether they can be retrofitted in time — and at what cost — before the next wave of strikes.

Gulf Cloud Infrastructure: The Exposure

The following table maps major technology investments across the Gulf against their security exposure in the context of the current conflict.

The geography is unforgiving. Facilities on the Gulf coast — in Dammam, Bahrain, and the UAE — sit within easy range of Iran’s drone fleet. Only Oracle’s Jeddah region, located on the Red Sea coast roughly 1,500 kilometers from Iran, offers meaningful geographic insulation, though it faces its own supply chain vulnerabilities related to the broader conflict.

Can You Insure a Data Center in a War Zone?

The strikes have opened a legal and financial fault line that may prove more consequential than the physical damage itself. Standard commercial property insurance policies contain war exclusion clauses. If Amazon and its customers publicly attribute the damage to Iranian military strikes — which they have — insurers may invoke those exclusions and decline to pay.

This creates a paradox. Companies need to be transparent with customers about what happened and why services are down. But every public statement attributing the outage to military action may simultaneously undermine their insurance claims.

The Insurance Journal reported Monday that the data center strikes have prompted urgent re-evaluation of war risk coverage for technology infrastructure across the Gulf. Maritime insurers have already cancelled war risk coverage for vessels transiting the Persian Gulf after Iran declared the Strait of Hormuz closed. Market estimates suggest marine hull rates for Gulf transits could rise by 25 to 50 percent, with some cases potentially doubling.

For data centers, the calculus is even more uncertain. War risk insurance for technology infrastructure in the Gulf barely existed as a product category before last week. Kennedys Law, the international law firm specializing in insurance and reinsurance, published an analysis noting that the implications for the insurance market will be considerable, as the conflict raises fundamental questions about the insurability of critical digital infrastructure in contested geographies.

The downstream effects for tech companies evaluating Gulf expansion are significant. If you cannot insure a data center against the most probable threat it faces, the economics of building one change dramatically.

Has the War Broken Vision 2030’s Tech Pillar?

Not yet. But it has exposed a contradiction at the heart of Saudi Arabia’s diversification strategy that can no longer be papered over with investment announcements.

Vision 2030 rests on the premise that Saudi Arabia can simultaneously be a military ally of the United States, a diplomatic partner of China, a regional rival of Iran, and a safe harbor for global capital and technology. The drone strikes on AWS facilities have demonstrated that at least two of these roles are incompatible.

The technology pillar of Vision 2030 is not a side project. It is central to the entire economic diversification thesis. NEOM, the $500 billion mega-project on the Red Sea coast, is designed as a fully connected urban environment where AI serves as the operating system for everything from autonomous transport to energy grids. THE LINE, NEOM’s most ambitious component, is an experiment in AI-driven urban planning that requires exactly the kind of reliable, low-latency cloud infrastructure that just went offline 800 kilometers away.

The Kingdom’s Public Investment Fund backed Humain, the AI company that secured 18,000 Nvidia Blackwell chips and a $10 billion deal with AMD to develop AI infrastructure. DataVolt, another Saudi-based company, committed $20 billion to AI data centers and energy infrastructure. These are not speculative plays. They represent the core of Saudi Arabia’s post-oil economic identity.

But AI infrastructure requires something that oil infrastructure does not: continuous, uninterrupted uptime. A pipeline can be repaired and restarted. A server room flooded by fire suppression water, containing drives with customer data, presents an entirely different recovery challenge. The war that Saudi Arabia supported is now threatening the economic future it is trying to build.

Where Is Beijing in All of This?

China brokered the March 2023 agreement that restored Saudi-Iranian diplomatic relations. That deal was celebrated as evidence that Beijing could serve as a credible alternative to Washington as a security guarantor in the Gulf. Three years later, the agreement lies in ruins, and China is watching Gulf technology infrastructure — much of it built with American capital and Chinese components — burn.

The irony is layered. GCC mobile network operators have deployed 5G networks predominantly through partnerships with Chinese firms Huawei and ZTE. Chinese tech providers have embedded themselves across the Gulf, supplying critical infrastructure including cloud platforms, smart city systems, and surveillance networks. The Carnegie Endowment for International Peace noted in an October 2025 analysis that the Gulf states have become indispensable strategic partners in China’s quest for economic resilience and expanded global influence.

Beijing’s position is awkward. China is the Gulf’s largest trading partner and a major consumer of Gulf energy. It has no interest in seeing the region destabilized. But the conflict was triggered by a U.S.-Israeli military operation that China opposed, targeting an Iranian government with which China maintains significant economic ties. The Gulf monarchies, as the Carnegie Endowment wrote this week, are caught between Iran’s desperation and America’s recklessness.

For Saudi Arabia specifically, the Chinese relationship adds another variable to the data center equation. Washington has loosened chip export restrictions to the Gulf — the Nvidia Blackwell shipment to Humain was a direct result of Trump’s May 2025 visit — but those permissions could be tightened again if U.S. officials perceive that Chinese firms have too much access to Gulf AI infrastructure. The war has not changed this dynamic, but it has made every calculation more fraught.

Why Did Air Defenses Fail to Protect Civilian Infrastructure?

The UAE’s air defense performance was, by most measures, impressive. Intercepting 506 of 541 drones — a 93.5 percent success rate — represents a significant achievement against a saturation attack. But air defense is a game of absolutes for the targets that get hit, and 35 drones that penetrate a defensive screen can cause disproportionate damage if they strike the right targets.

The cost asymmetry remains the fundamental problem. Iran’s Shahed-136 drones cost an estimated $20,000 to $50,000 each. The interceptors used to shoot them down — whether Patriot missiles, THAAD rounds, or NASAMS munitions — cost anywhere from several hundred thousand to several million dollars per shot. Iran can afford to lose 506 drones if 35 get through. The defenders cannot afford to run out of interceptors.

Data centers present a particular challenge for air defense planners. Unlike military bases, which are hardened and dispersed, commercial data centers are concentrated, fragile, and full of equipment that is destroyed by heat, water, and concussive force. A drone that misses a military target by 50 meters may cause no damage. A drone that strikes near a data center — as happened in Bahrain, where the strike was in “close proximity” rather than a direct hit — can still cause catastrophic disruption through secondary effects.

Saudi Arabia’s own air defenses will face an identical challenge as conflict continues. The Kingdom has invested heavily in Patriot batteries and is in discussions for additional THAAD systems, but the cost of sustained defense against cheap drones is economically unsustainable over a prolonged conflict. Every data center under construction in the Eastern Province — AWS, Microsoft, Google — sits behind the same defensive architecture that proved 93.5 percent effective and 6.5 percent catastrophic in the UAE.

What Comes Next for Gulf Tech?

The immediate priority is recovery. AWS has said the process will be prolonged, and companies with workloads on the affected regions are scrambling to migrate to alternative infrastructure. For some, that means rerouting to AWS regions in Europe, Mumbai, or Singapore — defeating the entire purpose of having Gulf-based data centers for regional latency and data sovereignty compliance.

The medium-term question is whether the Gulf’s data center boom pauses, relocates, or restructures. Several possibilities are emerging:

Geographic Redistribution

Expect renewed interest in data center locations on the Red Sea coast and in inland positions farther from the Gulf littoral. Oracle’s Jeddah region, approximately 1,500 kilometers from Iran, may see increased demand. Riyadh-based facilities, while not immune to long-range ballistic missiles, are outside the effective range of the low-cost drones that struck the UAE.

Hardening and Redundancy

The Semafor analysis published Monday noted that data centers have not traditionally been designed to withstand military attack. That will change. Expect new construction in the Gulf to incorporate blast-resistant structures, underground components, and distributed architectures that can survive the loss of individual facilities without region-wide outages.

Contractual Renegotiation

Cloud service agreements for Gulf regions will be rewritten. Force majeure clauses, service level agreements, and data recovery commitments will all be reconsidered in light of a threat model that now includes state-sponsored military strikes. Customers will demand — and pay premiums for — multi-region failover guarantees.

Sovereign Infrastructure

The strikes may accelerate Gulf governments’ push toward sovereign cloud infrastructure that they control and can defend. The SDAIA Hexagon Data Center in Riyadh, designed as a national facility rather than a commercial cloud operation, represents this model. Saudi Arabia’s National Cybersecurity Authority may push for data localization requirements that prioritize government-controlled facilities over foreign commercial operations.

The Kingdom’s ruling family faces a strategic choice. Doubling down on the tech diversification bet requires either ending the conflict or investing heavily in the physical defense of digital infrastructure. Under King Salman and Crown Prince Mohammed bin Salman, the Kingdom has shown a willingness to spend its way through obstacles. Whether it can spend its way through a war remains the open question of 2026.

The Precedent That Cannot Be Undone

Beyond the immediate disruption, the AWS strikes have established a precedent that will shape global technology infrastructure planning for years. This is the first confirmed military strike on a major U.S. technology company’s data center. It will not be the last time the scenario is considered.

Every multinational corporation with data in the Gulf is now conducting emergency reviews of its geographic risk exposure. Every insurance underwriter is repricing war risk for technology assets. Every cloud provider is stress-testing its disaster recovery plans against a threat model that, until Sunday, most of them treated as theoretical.

The Gulf’s pitch to the technology industry was always built on a specific proposition: abundant energy, favorable tax regimes, growing regional demand, and above all, political stability guaranteed by American military power and Gulf sovereign wealth. The drone strikes did not destroy that proposition entirely. But they introduced a variable — active military conflict — that no amount of sovereign wealth can fully offset.

For Saudi Arabia, the calculus is particularly acute. The Kingdom is building its entire post-oil economic identity around technology, artificial intelligence, and digital services. It is simultaneously entangled in a regional conflict that has already struck the infrastructure of its closest ally and neighbor. These two realities cannot coexist indefinitely. Something will have to give — either the war or the vision.

The drones that hit the AWS data centers on Sunday carried warheads. But the real payload was a question that every tech executive, every sovereign wealth fund manager, and every government planner in the Gulf is now forced to answer: can you build the future on infrastructure that the present can destroy in an afternoon?

Frequently Asked Questions

How many AWS data centers were hit by Iranian drones?

Three facilities were affected. Two AWS data centers in the UAE were directly struck by drones, and one facility in Bahrain was damaged by a drone strike in close proximity. The attacks occurred on March 1-2, 2026, as part of Iran’s broader retaliatory campaign against Gulf states following U.S.-Israeli strikes that killed Supreme Leader Khamenei.

Which banking and financial apps went down after the AWS strikes?

Emirates NBD and Abu Dhabi Commercial Bank (ADCB) reported banking platform and mobile app outages. Payment companies Alaan and Hubpay experienced disruptions. Careem, the ride-hailing and delivery platform, reported service failures. Enterprise data platform Snowflake also confirmed outages for customers with Gulf-hosted workloads.

How long will AWS recovery take in the UAE and Bahrain?

AWS has described the expected recovery timeline as “prolonged” without providing a specific date. The physical nature of the damage — structural impacts, power infrastructure disruption, and water damage from fire suppression systems — means recovery involves hardware replacement and facility repair, not simply rebooting servers. Customers have been advised to reroute operations to unaffected regions.

Does Saudi Arabia have its own cloud data centers that could be targeted?

Yes. AWS is investing $5.3 billion in a Saudi cloud region launching in 2026. Microsoft is building three data centers in the Eastern Province for Q4 2026. Oracle operates regions in Jeddah and Riyadh. Google Cloud has a Dammam region. SDAIA is building the government-backed Hexagon Data Center in Riyadh. Facilities on the Gulf coast face the highest threat exposure from Iranian drones and missiles.

Will insurance cover data center damage from military drone strikes?

Coverage is uncertain. Standard commercial property policies contain war exclusion clauses that insurers may invoke when damage is attributed to military action. War risk insurance for technology infrastructure in the Gulf barely existed as a product category before the strikes. Companies face a dilemma: publicly attributing damage to Iranian military action helps explain outages to customers but may simultaneously undermine insurance claims.