Drones Hit Amazon’s Datacenters. The Cloud Just Got a Lot More Fragile.

Three Amazon Web Services facilities in the Middle East are offline. Two were directly struck by drones in the UAE. A third in Bahrain was damaged by a drone strike close enough to knock it out, as The Register reported.

This is the first time in history that a military adversary has successfully attacked a major American cloud provider’s physical infrastructure. It will not be the last.

What Actually Went Down

At approximately 4:00 AM PST on Sunday, March 1, the first drone struck an AWS availability zone in Dubai. AWS initially described it as a localized power issue. Within hours, a second UAE facility was hit. By Sunday evening, a third facility in Bahrain went down after a nearby strike caused physical impact to that infrastructure.

By Monday, March 2, AWS confirmed what everyone already suspected. Two UAE facilities, availability zones mec1-az2 and mec1-az3, had been directly struck by drones. Structural damage. Disrupted power delivery. Fire suppression activities that added water damage on top of everything else. In Bahrain, zone mes1-az2 took a proximity hit with the same result: power out, connectivity gone, recovery timeline measured in days.

Twenty-five AWS services were listed as fully disrupted. Thirty-four more were degraded. Fifty-one more were impacted. That is 110 services across two regions simultaneously compromised. The list reads like a blueprint of modern digital infrastructure: EC2, S3, DynamoDB, Lambda, Kinesis, CloudWatch, RDS, the Management Console itself. All of it down or crippled.

AWS’s own health dashboard told the story in real time. S3, the foundational storage service, is designed to survive the complete loss of a single availability zone. When mec1-az2 went down first, S3 kept running. When mec1-az3 followed hours later, S3 collapsed. The architecture held against one strike and failed against two simultaneous ones. That is not a design flaw. That is what two coordinated hits look like against a system built to survive one.

By March 3, AWS was still pushing updates every few hours and telling customers the same thing in increasingly plain language: get your data out of the Middle East now. Move to US, Europe, or Asia Pacific regions. Do not wait for restoration. There is no reliable timeline.

The Problem Nobody Wanted to Talk About

Here is the reality the tech industry has been quietly avoiding for years. Datacenters are enormous, unmissable physical structures. They consume massive amounts of power, which means they sit next to visible power infrastructure.

They generate heat, which means they require industrial cooling systems visible from the street. They are, in the language of military targeting, soft targets. Large, stationary, easy to locate, and not hardened against kinetic attack.

AWS launched its Middle East infrastructure between 2019 and 2022, placing regions in Bahrain, the UAE, and Israel precisely because Gulf governments were willing to pay premium rates for local cloud hosting of sensitive data.

Governments. Banks. Defense-adjacent agencies. The very customers that make a datacenter geopolitically interesting as a target.

The downstream effects were immediate across the Gulf. Careem, the region’s dominant ride-hailing and delivery platform, went down. Payment processors Alaan and Hubpay reported outages. Banks including ADCB and Emirates NBD experienced service disruptions. Businesses running on AWS infrastructure across the region went dark simultaneously with no timeline for restoration.

Iran’s state-aligned Fars News Agency claimed via Telegram that the AWS facilities were targeted deliberately to probe their role in supporting U.S. military and intelligence activities. The claim is propaganda from a wartime actor and deserves to be read as such. But the parts that can be verified against AWS’s own statements all check out.

The specific facilities named. The scope of damage described. The recovery recommendations issued. Fars knew what it was talking about because it accurately described what actually happened.

The drone is what made this possible at scale. A cruise missile strike on a datacenter in Bahrain in 2003 would have been an act of war requiring significant military capability and leaving no ambiguity about attribution.

Low-cost drones in 2026 cover the same distance, hit multiple targets in sequence, and complicate immediate attribution. The delivery mechanism has changed everything about the threat calculus.

What the Recovery Actually Looked Like

The AWS health dashboard documented the collapse and the slow crawl back in granular, painful detail.

By March 2, recovery was estimated at “at least a day.” By March 3, that estimate was unchanged. Power had not been restored to the affected zones. Cooling systems were damaged.

Local authorities had to approve re-energization before AWS engineers could safely bring anything back online. The physical reality of structural damage does not yield to software workarounds.

AWS pursued parallel paths: software mitigations to partially restore S3 and DynamoDB access without waiting for physical repairs, and simultaneous infrastructure repair work on the ground.

The software path helped. It was not enough. Services like EC2 instance launches remained throttled days after the initial strikes because physical capacity in the damaged zones simply did not exist.

The third UAE zone, mec1-az1, stayed operational and absorbed the load from the two damaged zones. That is the redundancy architecture working exactly as designed. The problem is that it worked partially, not completely.

Two of three zones in the same geographic region were struck simultaneously, which is precisely the scenario the three-zone architecture was not built to survive.

AWS’s guidance shifted noticeably over the course of the crisis. Early updates recommended customers use the unaffected availability zone. By March 2, the recommendation had changed entirely: move out of the Middle East region altogether. US, Europe, Asia Pacific. The third UAE zone was no longer presented as sufficient.

DroneXL’s Take

Here’s what I actually think: this story is about drones, but it is really about the gap between how the tech industry thinks about risk and how the military thinks about it.

Cloud providers built their Middle East expansion around commercial risk models. Earthquakes. Power failures. Software outages. Cooling system failures. None of those models adequately accounted for a nation-state deciding that your datacenter is a legitimate military target and acting on that decision with low-cost expendable aircraft.

No sugarcoating this: the drone changed that equation permanently. Not because drones are new. Because cheap, precise, expendable drones available at scale have made physical attacks on soft infrastructure not just possible but operationally attractive.

The cost to the attacker is trivial. The cost to the target is 110 services disrupted across two countries, recovery measured in days, and a customer base being told to evacuate an entire region.

The DroneXL audience spends a lot of time thinking about drones as tools for good. DFR programs. Search and rescue. Mapping. Conservation. All of it real and important. But the same underlying technology is being used right now to knock out the infrastructure that runs your bank, your delivery app, and half the internet in an entire region.

The AWS health dashboard was still updating every few hours as of March 3. One hundred and ten services disrupted. Structural damage. Water damage from fire suppression. Power systems requiring approval from local authorities before anyone could touch them. A recovery timeline that nobody could commit to.

The cloud just learned that lesson the hard way. The rest of the industry is already taking notes.

Photo credit: AWS