MANAMA — The Islamic Revolutionary Guard Corps claimed on July 21 that it struck and destroyed Amazon Web Services’ data center in Bahrain with cruise missiles, in stated retaliation for the US strike on Iran’s Darkhovin nuclear power plant two days earlier. The claim, carried by IRNA, Tasnim, and Iran International but unconfirmed by Amazon or CENTCOM, would mark the first use of cruise missiles against commercial cloud infrastructure in the Gulf conflict and at least the third kinetic action against the same AWS facility since March.
The IRGC packaged the data center strike alongside claimed hits on US air-defense radar at Muharraq and a Patriot battery at Riffa, treating Amazon’s commercial cloud as operationally equivalent to the military systems defending Bahrain’s airspace. For Saudi Arabia, which launched its own in-kingdom AWS region in Riyadh six months before the war began and still carries legacy workloads in Bahrain, the targeting logic the IRGC applied to a building twenty-five kilometres across the causeway now covers every piece of US-branded digital infrastructure in the Gulf — from Aramco’s cloud-integrated operational technology to NEOM’s planned 1.5-gigawatt data center campus.
Table of Contents
The Wave 24 Strike Package
The IRGC’s public relations office stated that its Aerospace Force, “in continuation of the 24th wave of Operation Nasr-2, in response to the aggression and violation by the child-killing American army against the under-construction and civilian facilities at Darkhovin, attacked the central data infrastructure of the American company Amazon in Bahrain with several cruise missiles and destroyed it.” The statement was distributed through Mehr News Agency and Tasnim on July 21, 2026, and reported by Euronews, Iran International, and Data Center Dynamics.
The AWS claim was not isolated. IRNA reported that the same wave included a strike on a US radar station at Muharraq and a combined missile-and-drone attack on a US Patriot air-defense system at Riffa — both in Bahrain. The combination matters: by suppressing air-defense installations and striking the commercial target in a single coordinated operation, the IRGC treated a data center as a military-grade objective warranting the same operational planning it applied to radar and interceptor batteries.
The IRGC provided no strike imagery. The stated justification — the US attack on Darkhovin — marked the first time the Guard had linked a commercial infrastructure strike explicitly to a nuclear facility.
Why Did the IRGC Cite Darkhovin?
The IRGC linked the AWS strike directly to the US attack on Iran’s Darkhovin nuclear power plant, which the Atomic Energy Organization of Iran said occurred at approximately 3:39 a.m. local time on July 19, 2026. CENTCOM confirmed it had completed strikes on Iranian military infrastructure on the evening of July 18 Eastern time, with the Darkhovin site appearing in a target package that also included coastal surveillance facilities, naval assets, and IRGC positions. The interval between the Darkhovin strike and the IRGC’s AWS claim was approximately forty-eight hours.
The Middle East briefing 3,000+ readers start their day with.
One email. Every weekday morning. Free.
Darkhovin is an indigenously designed 360-megawatt nuclear power plant in Khuzestan province, roughly seventy kilometres south of Ahvaz on the Karun River. Construction restarted in December 2022, with an estimated cost of $1.5 to $2 billion over eight years, and the IAEA confirmed the site contained no nuclear material and posed no radiological risk at the time of the strike. Iran’s AEOI condemned the attack as “a violation of international law and an assault on a symbol of the country’s scientific progress,” and Iran’s UN Ambassador Amir Saeid Iravani demanded the Security Council issue a formal condemnation.
The retaliation framing establishes a new escalation tier within Operation Nasr-2. The IRGC’s previous twenty-three waves were presented as responses to US strikes on military targets — bases, radar installations, ships, and IRGC positions. Wave 24’s explicit linkage to a nuclear facility, even one under construction with no fissile material on site, introduces a different stated principle. Under it, any US strike on Iranian nuclear infrastructure — regardless of the site’s operational status or radiological content — authorizes retaliatory strikes on US commercial infrastructure anywhere in the Gulf. The IRGC has now applied that principle to the same Bahrain facility three times in five months.
How Many Times Has AWS Bahrain Been Struck?
The July 21 claim marks at minimum the third distinct IRGC attack on AWS infrastructure in Bahrain this year, with a fourth strike hitting Batelco’s headquarters in Manama — which houses AWS infrastructure — in early April. The escalation is not just in frequency but in lethality: the campaign opened with drones in March, progressed to missiles against adjacent infrastructure in April, and — if the July claim is accurate — has now reached cruise missiles aimed at claimed destruction rather than disruption.
| Date | Target | Method | Confirmed Impact |
|---|---|---|---|
| March 1 | AWS ME-SOUTH-1 (plus AWS UAE) | Shahed drones | Structural damage, fires, power outages; multiple AZs offline 24+ hours |
| Late March | AWS ME-SOUTH-1 | Drones | Further power outages, water shortages; AWS told all ME customers to migrate |
| April 1 | Batelco HQ, Manama (hosts AWS) | Missiles | Fire and structural damage to building housing AWS infrastructure |
| July 21 | AWS ME-SOUTH-1 | Cruise missiles (claim) | IRGC claims complete destruction; unconfirmed |
The March 1 strike was the first kinetic attack on hyperscale cloud infrastructure in wartime, according to Data Center Dynamics and CNBC. Amazon confirmed structural damage, fire, and water damage from fire suppression at its Bahrain facility, with multiple Availability Zones going offline for more than twenty-four hours. Banking services across the Gulf went down with it — Abu Dhabi Commercial Bank, Emirates NBD, First Abu Dhabi Bank, the payments platforms Hubpay and Alaan, and Careem, the ride-hailing company that serves thirty-three million customers in fourteen countries, all reported service interruptions.
AWS’s response was without precedent for a hyperscaler: the company waived all usage charges for its ME-CENTRAL-1 region for March and told customers that full restoration of its Bahrain and UAE regions would “take several months,” offering migration assistance to alternate regions. As of late April 2026, thirty-one AWS services in the two regions remained listed as disrupted, according to Network World. The IRGC’s July cruise missile claim, if accurate, means the Guard struck a facility that Amazon had not yet finished repairing from the spring.
The IRGC’s Expanding Commercial Target List
The AWS strikes did not emerge from an improvised targeting decision. On March 31, 2026, the IRGC formally declared eighteen US technology companies “legitimate military targets” — Amazon, Microsoft, Google, Apple, Meta, Oracle, Intel, HP, IBM, Cisco, Dell, Nvidia, Palantir, Tesla, Boeing, General Electric, JPMorgan Chase, and G42, the Abu Dhabi-based AI firm — and urged anyone within one kilometre of their Gulf facilities to evacuate, according to CNBC and Time. The declaration converted a battlefield reality into standing doctrine: a named list, a stated legal rationale grounded in dual-use classification, and a demonstrated willingness to execute.
The Center for Strategic and International Studies assessed in March 2026 that Iran’s operational target list had expanded to twenty-nine technology facilities across Bahrain, Israel, Qatar, and the UAE — five AWS sites, five Microsoft, six IBM, four Google, three Nvidia, three Oracle, and three Palantir. Dennis Murphy, a researcher at Georgia Tech, described commercial data centers in The Conversation on April 1 as “large, relatively fragile and lack dedicated air defenses,” calling them high-value targets that the Gulf’s six-hundred-billion-dollar AI infrastructure build-out “never adequately priced into its risk models.”
Nothing stays hidden to our sight, though hidden by Google.
IRGC Brig. Gen. Ebrahim Zolfaghari, on-screen message accompanying satellite imagery of OpenAI’s $30 billion Stargate campus in Abu Dhabi, April 3, 2026
Zolfaghari’s demonstration, reported by Small Wars Journal and Arizona State University, indicated that the IRGC’s targeting pipeline now includes planned and under-construction digital infrastructure — not just operational sites with live data and active customers. The category covers NEOM’s $5 billion DataVolt hyperscale data center campus in the Oxagon industrial zone, Aramco’s cloud-dependent digital strategy, and any future AWS expansion in the kingdom, all of which exist at varying stages between announcement and operation.
What Does This Mean for Saudi Arabia’s Cloud?
Saudi Arabia’s direct exposure to the Bahrain strikes is a consequence of timing. AWS me-central-2, the in-kingdom region based in Riyadh, reached general availability in January 2026 with three Availability Zones and a $5.3 billion Amazon investment commitment — but general availability is not the same as complete migration. Enterprises that spent seven years building workloads on ME-South-1 in Bahrain cannot relocate them to Riyadh with a configuration change, and the war began before most had started the process.
The scale of Saudi cloud dependency registers at national level. Cloud spending in the kingdom exceeded SAR 15 billion, approximately $4 billion, in 2025, growing at more than 25 percent annually according to industry estimates. Aramco CEO Amin Nasser described AWS as a core pillar of a $90 billion US technology deal package signed in 2025, and the company has integrated cloud and AI tools across refining, logistics, and sustainability operations, with a separate MOU with the industrial cybersecurity firm Dragos to protect its OT environments — an acknowledgement of vulnerability that does not constitute a defence against cruise missiles.
The competitive dynamic is already visible. Huawei Cloud posted on its Gulf regional account in March 2026 that “single-region dependency is a thing of the past” and has been pitching multi-cloud resilience to Gulf clients displaced by the strikes, according to Rest of World. The IRGC’s declared target list names only US companies, a gap that Huawei’s regional sales teams have treated as a commercial advantage — though the assumption that Chinese infrastructure would remain permanently exempt from the same targeting carries its own category of geopolitical risk.
Background
Operation Nasr-2 is the IRGC’s designation for its retaliatory campaign against US military and commercial infrastructure across the Gulf, launched in response to the US-Iran military confrontation that escalated into sustained operations in 2026. The campaign has progressed through twenty-four declared waves, expanding sequentially from fixed military installations to logistics hubs, energy infrastructure, desalination and electrical capacity, and — since March — digital infrastructure. The July 21 strikes coincided with ongoing US operations including CENTCOM’s Night Ten strikes on Bandar Abbas and the broader closure of maritime lanes around the Arabian Peninsula.
AWS ME-South-1 opened in Bahrain on July 30, 2019 as Amazon’s first cloud region in the Middle East, operating three Availability Zones with independent power, cooling, and networking across the Manama metropolitan area. The region supported 146 AWS services and served as the primary cloud hub for Gulf enterprise and government customers until AWS launched me-central-2 in Saudi Arabia in January 2026. AWS’s Middle East operations were estimated to generate $1.5 to $2.5 billion annually before the conflict began.
Frequently Asked Questions
Has Amazon confirmed the July 21 strike on its Bahrain data center?
No. As of publication, Amazon Web Services had issued no public statement on the IRGC’s July 21 claim, and neither the Bahraini government nor CENTCOM had confirmed or denied any element of it. Amazon’s most recent public statement on its Gulf operations, from April 2026, said restoring the Bahrain and UAE regions would “take several months” following the March strikes — leaving open the possibility that the facility was still under repair, partially operational, or offline when the July attack was claimed.
Which AWS services does the Bahrain region host?
ME-South-1 supported 146 AWS services including EC2 compute instances, S3 object storage, RDS managed databases, Lambda serverless computing, and SageMaker machine learning tooling. Saudi government platforms, financial institutions, and enterprise workloads built on these services between 2019 and January 2026 were architected for Bahrain’s specific Availability Zones, compliance certifications, and network peering arrangements — migrating them to the Riyadh region requires re-architecture, re-certification, and contract renegotiation, a process measured in years rather than months.
What is the difference between a drone strike and a cruise missile strike on a data center?
The March 2026 attacks used Shahed-series drones, which travel at roughly 150 to 185 kilometres per hour and carry warheads between 30 and 50 kilograms — enough to damage exterior structures, trigger fires, and disrupt power systems, but not to destroy hardened infrastructure in a single pass. Cruise missiles typically carry warheads of 450 to 700 kilograms at subsonic or near-sonic speeds, making them harder to intercept and capable of penetrating reinforced structures. The escalation from drones to cruise missiles suggests the IRGC concluded that drone-level damage was being repaired between strikes and that permanent degradation of the target required a higher-yield weapon.
Could the IRGC target the AWS region in Riyadh?
The IRGC’s March 31 target declaration named Amazon Web Services as a company without distinguishing between cloud regions or geographies. CSIS identified five AWS facilities on the expanded target list in March 2026 but did not publicly specify whether the Riyadh region, which had been operational for only two months at the time of the assessment, was among them. Riyadh sits approximately 800 to 850 kilometres from Iranian launch positions, within the range envelope of the IRGC’s Fattah-2 hypersonic missile and the Zolfaghar ballistic missile family — the same threat range that has already placed Prince Sultan Air Base inside the conflict’s targeting geography.
