On Tuesday, Amazon Web Services confirmed what its Gulf customers had been dreading since spring: it cannot restore access to data in its Bahrain region, and it cannot restore resources in one of the three availability zones in the United Arab Emirates — the zone AWS designates mec1-az2 — that Iranian drone swarms damaged in the opening days of the war. Reuters saw the status update first; the Journal reported it Tuesday. Doug Madory of Infoblox told the Journal that a cloud region losing customer data to an airstrike appears to be a first.
Read the verb again. AWS did not say it cannot serve the data. It said it cannot restore it.
Redundancy Was Never the Same Thing as Restoration
The disaster-recovery industry is built on a threat model of independent, accidental failure. A disk dies; a rack loses power; a switch misbehaves. Those events are uncorrelated, which is exactly why three availability zones is a coherent sales pitch: the odds of all three failing at once are small enough to put on a slide.
A drone campaign is not uncorrelated. It is the opposite of an accident. The Journal notes that the damage in Bahrain spanned multiple availability zones — meaning the redundancy that was supposed to be structural was, in the event, decorative. The three-zone diagram is a map of failure domains that assumes the failure arrives one rack at a time.
Then comes the quieter problem. AWS says it has supported customers in “reestablishing operations in alternative regions.” Reestablishing. Not recovering. Anyone who has rebuilt a production system from a snapshot knows the distance between those two words, and knows it is measured in quarters, not hours. Backups restore data. They do not restore a running business — the config, the keys, the in-flight state, the three years of accumulated exceptions nobody documented because the system had never gone down.
“We had backups,” a second-year reliability engineer at a Gulf fintech wrote in her company’s incident channel at 3 a.m. Dubai time. “Nobody had ever tested getting back.”
The Sovereignty Debate Never Ran the War-Risk Column
The Gulf data-center buildout was sold as a sovereignty play. Governments and banks wanted their data in-country; the hyperscalers wanted the contracts; both sides got to use the word “sovereign” in a press release. Brussels spent years litigating the same question as a matter of privacy and jurisdiction. The opposing camp — location doesn’t matter, architecture is durable — was equally confident, and equally wrong.
Both camps made the identical error. They treated durability as a property of design. It is a property of geography, of law, and of somebody’s willingness to keep funding a copy they will probably never touch.
Here is the uncomfortable arithmetic: a residency requirement, layered on top of the availability-zone fiction, produces a single copy of a system with a national flag on it. The sovereignty advocates will read Tuesday’s news as vindication — see, keep your data home. But the data was already home. There was simply nowhere else for it to be.
The Loss Lands Where the Contract Says: On the Customer
Nobody underwrote this, and that is the part the industry would prefer not to discuss. Standard cloud contracts run on service credits and force-majeure language, and “act of war” is boilerplate in property and cyber policies alike. Everyone carved it out. Which means the residual risk — customer data that no longer exists — sits on the balance sheet of the company that believed it had purchased resilience.
The board that approved the migration three years ago thought it was transferring continuity risk. It transferred availability risk and kept the catastrophe. The auditors who signed off on the cloud strategy asked the right questions about access controls and the wrong ones about geography. And the insurance market, which has spent a decade writing cyber policies with a war exclusion tucked inside them, has now watched that exclusion swallow an entire loss.
Note who has to update their priors here, because it is not the usual cast. It is the sovereign-cloud sales teams who promised in-country meant safer. It is the finance chiefs who told their boards that multi-zone architecture was a substitute for a second country. It is the underwriters who excluded the one risk that just materialized.
If you want to know what your continuity plan is actually worth, find the sentence in your contract that covers this exact scenario and read it aloud in a meeting. That is the plan.
The cloud was always a place. It had a street address the whole time. Last Tuesday, we finally learned which copy of the business was in it.