Iranian Drones Hit Three AWS Data Centers. Forty-Six Cloud Services Went Down. Your Insurance Doesn't Cover It.
The first kinetic military attack on hyperscale cloud infrastructure proved that "the cloud" is a building with an address. A $20,000 drone just took out two-thirds of a region's redundancy.
Three buildings. That's what it took.
On March 1, 2026, Iranian drones struck two Amazon Web Services data centers in the United Arab Emirates and damaged a third in Bahrain. It was the first confirmed kinetic military attack on a major hyperscale cloud provider in history. Forty-six AWS services went offline across the Middle East. Structural damage, power delivery disruption, fires, water damage from suppression systems. Amazon used the word "prolonged" to describe recovery.
On March 23, it happened again. A second drone disruption hit Bahrain. Two attacks in 23 days on the same cloud infrastructure. Amazon's advice to customers: migrate your workloads to another continent.
What the Abstraction Hid
Cloud computing is marketed as geography-free. "Serverless." "Elastic." "Distributed." AWS tells customers their data lives in "regions" and "availability zones," terminology designed to evoke something diffuse and resilient. In reality, an availability zone is a cluster of buildings within a few miles of each other, and a region is a collection of those clusters within a single metro area.
ME-CENTRAL-1, AWS's UAE region, has three availability zones. Drones directly hit two of them, leaving mec1-az2 and mec1-az3 "significantly impaired" and Bahrain zone mes1-az2 offline from a proximity strike. Two-thirds of a region's physical redundancy, eliminated in a single attack.
A single availability zone can serve thousands of enterprise customers simultaneously. Banking apps, payment gateways, ride-hailing services like Careem, food delivery platforms, and enterprise software all went dark across the Gulf. Multi-availability-zone architecture assumes zones fail independently. Nobody modeled "all three zones get hit by the same military operation."
A Novel Calculation: What the Asymmetry Costs
An Iranian Shahed-136 drone costs an estimated $20,000-$50,000 per unit. AWS's Middle East regions serve a cloud market projected to reach $14.2 billion by 2028. At roughly $3.5 billion annually today, and assuming AWS holds its 31% market share in the region, the Middle East operation handles on the order of $1 billion in annual cloud spend. A two-week outage affecting a significant share of that workload implies nine-figure downstream disruption. An October 2025 AWS outage (software failure, not kinetic) produced insured losses estimated by CyberCube at $38 million to $581 million, and that event was shorter and less physically destructive.
That ratio: roughly $2,000-$29,000 in economic damage per dollar spent on the attack. For context, a conventional cruise missile strike on military infrastructure typically achieves 10:1 to 50:1. A $30,000 drone disabling cloud services worth hundreds of millions makes the $400-drone-vs-$3-million-tank equation look modest.
Insurance: Nobody Is Covered
Standard commercial policies contain war exclusion clauses. Cyber insurance covers network intrusions, ransomware, and data breaches. Property insurance covers fire, flood, and sometimes terrorism. None of them clearly cover "a foreign military flew a drone into your cloud provider's building."
It sits in a gap between policy categories. Cyber insurance excludes physical damage. Property insurance excludes acts of war, though the legal definition of "war" varies by policy: some require a formal declaration between sovereign states, which the Iran-US conflict technically isn't. Terrorism insurance (available through TRIA in the United States) generally covers certified acts on US soil, not foreign military operations against data centers in Bahrain. Business interruption insurance often has military action exclusions, and individual policy terms vary. But the burden of proving coverage falls on the policyholder, and the ambiguity itself is the problem.
Data center insurance is a $1.5 billion market growing 15% annually, priced for fire risk (OVHcloud's 2021 Strasbourg blaze destroyed an entire facility and took 3.6 million websites offline), floods, and power failures. It was not priced for drone strikes. If you ran production workloads on ME-CENTRAL-1 and lost revenue in March, your insurer's likely answer: war exclusion, claim denied.
Geographic Attack Surface
AWS operates 33 regions globally with over 105 availability zones. Cross-referencing top cloud regions by capacity with the IISS Armed Conflict Survey reveals uncomfortable overlap:
| Cloud Region | Provider(s) | Conflict Proximity | Risk Level |
|---|---|---|---|
| UAE / Bahrain | AWS, Azure, Oracle | Iran-US conflict zone (active) | Proven target |
| Israel | AWS, Azure, Google | Active multi-front conflict | High |
| South Korea | AWS, Azure, Google | 38th parallel (frozen conflict) | Elevated |
| Taiwan | AWS, Google | Taiwan Strait tensions | Elevated |
| Singapore | All major providers | South China Sea disputes | Moderate |
Iran's Fars News Agency claimed the strikes targeted facilities "supporting US military and intelligence activities, including AI workloads." Whether accurate or not, commercial cloud infrastructure has been formally classified by at least one state actor as a legitimate military target.
Strongest Counterargument
AWS's Middle East regions represent a tiny fraction of the company's $107 billion annual revenue. Amazon stock dropped 0.8%. Global services in the US, Europe, and Asia Pacific were completely unaffected. Regional isolation contained the blast radius. Architecture worked as designed at the macro level.
Fair. But the forward-looking risk matters more than the backward-looking stock move. Every state actor now has a case study in disabling digital infrastructure with $100,000 worth of drones. South Korea's AWS region handles workloads for Samsung, Hyundai, and the Seoul government. Taiwan's region processes semiconductor supply chain data. If the strategic logic holds, cloud regions in contested geographies are no longer theoretical targets. They are proven ones.
What We Don't Know
Amazon has not disclosed the specific number of affected customers, the dollar value of lost business, or the full restoration timeline. Whether the Bahrain facility was directly hit or damaged by a near-miss remains unclear (Amazon's language: "physical impacts to infrastructure" from "a drone strike in close proximity"). Insurance claims data won't be available for months. We also lack data on how many affected customers had functional multi-region failover, a distribution that determines whether the impact was brief or catastrophic for individual businesses. Flexera's 2025 State of the Cloud report found that fewer than 20% of organizations tested disaster recovery failover in the past year.
Bottom Line
Cloud was always a building. Now everyone knows it. March 2026 didn't just produce an outage. It created a new category of infrastructure risk sitting in an insurance gap, exceeding most enterprise threat models, executable for less than the cost of a luxury car. For the 93% of enterprises running on public cloud, the question is no longer "what if our region goes down?" It's "who decides when it goes down, and does our plan survive the answer being a foreign military?"