AWS Confirms Data in War-Damaged Middle East Availability Zones Is Permanently Unrecoverable
AWS says data held only in Bahrain's me-south-1 region and the UAE's mec1-az2 zone, hit by Iranian strikes in March, cannot be restored.
Overview
Amazon Web Services has told customers it cannot restore data that was stored exclusively in the Middle East facilities damaged during Iran’s drone strikes earlier this year, according to InfoQ. In a status update posted on September 15, AWS said it is “unable to restore access to the resources and data” hosted in the affected sites, according to Cyber Security News. The determination covers the mec1-az2 availability zone in AWS’s UAE region and the entirety of its Bahrain region, me-south-1, six months after the strikes first knocked those facilities offline.
What We Know
AWS issued separate assessments for the two regions it operates in the Gulf. For the UAE, the company stated: “After a thorough assessment, we have determined that we are unable to restore access to the resources and data hosted exclusively in the mec1-az2 availability zone. We continue to work on recovering regional resources, as well as zonal resources hosted in the other affected Availability Zones (mec1-az1 and mec1-az3),” according to InfoQ.
For Bahrain, AWS said the damage was too extensive to isolate to a single zone: “The damage to our infrastructure spanned multiple availability zones and exceeded what our regional and multi-AZ services are designed to withstand. After a thorough assessment, we have determined that we are unable to restore access to the resources and data hosted exclusively in this region,” the company said, according to InfoQ.
As previously reported, Iranian drones struck AWS facilities in the UAE and Bahrain in March, damaging two of the three availability zones in the UAE and one facility in Bahrain. Iran’s Islamic Revolutionary Guard Corps claimed a second attack on the Bahrain region in July, according to InfoQ. AWS says it is now replacing the affected infrastructure, has notified relevant authorities in both countries, and will provide further updates on service restoration in the coming months, with more detail on Bahrain specifically promised for early 2027, according to InfoQ. AWS has also suspended billing for the affected Bahrain region, according to Cyber Security News. AWS opened its Bahrain region in 2019 and its UAE region in 2022, according to InfoQ.
The announcement has driven discussion on Hacker News about what customers understood they were buying when they built on AWS’s multi-availability-zone architecture, according to InfoQ. A 2025 television interview with an AWS leader resurfaced in the discussion; asked what would happen if someone identified an unmarked AWS data center and destroyed it, she had answered: “Yeah, you wouldn’t notice. I mean, we might be a bit upset, but you wouldn’t notice!” according to InfoQ.
Commenters pushed back on that framing. Commenter krick wrote: “Claims like that are pretty common, they make sense and they should be true, so even though I don’t really know AWS redundancy planning in enough detail, I used to trust them. It’s really worrying when they outright say it will be ok, and then a week later it turns out to be not ok,” according to InfoQ. Commenter houssc added: “The caveat is always ‘if you’re using the service correctly’ which is not necessarily free. Meaning taking advantage of multiple geo zones, building in redundancy to your stack, etc.,” according to InfoQ. Commenter jacquesm went further, arguing that “they don’t realize that AWS is a toolbox, not a ‘ready made solution for redundancy against all catastrophes you are possibly exposed to,’” according to InfoQ.
What We Don’t Know
AWS has not disclosed how much data, or how many customers, were affected by the losses in mec1-az2 and me-south-1. The company has not said when recovery of the still-affected mec1-az1 and mec1-az3 zones in the UAE will be complete, only that work continues, according to InfoQ. Full detail on Bahrain’s path to restoration has been deferred until early 2027, according to InfoQ.
Analysis
AWS’s own documentation supports the reading that multi-AZ redundancy was never designed for this scenario. S3 Standard and related storage classes redundantly store objects across a minimum of three availability zones within a region, with AWS citing durability of 99.999999999% per year, according to InfoQ. Both of those guarantees are regional properties, not protections against the loss of an entire region — which is what happened in Bahrain.
Commenter dijit framed the underlying trade-off in distributed storage design: “You won’t notice that theres a third commit server off-site (unless that site is bombed), but you will notice slower writes,” according to InfoQ. Commenter lelanthran put the organizational dynamic more bluntly, asking “who is a CEO going to believe? Amazon, Microsoft and the entire IT infra division or that lone SRE who disagrees with them?” according to InfoQ.
Multi-AZ architecture distributes a workload across facilities within roughly 100 kilometers of each other, a design meant to protect against failure modes such as power outages, lightning strikes, tornadoes and earthquakes, according to InfoQ. It was not designed to withstand an attacker capable of reaching several of those facilities in the same conflict. Gregor Hohpe, co-author of Enterprise Integration Patterns, made that point explicit: “The risk is regional, not tied to a provider. The folks who took out ME-CENTRAL can just as easily take out Azure or any other data center,” according to InfoQ.
Six months after the strikes, that framing now has a concrete outcome attached to it. For any organization that had infrastructure in AWS’s Middle East regions, the practical question is no longer hypothetical: whether any assets sat exclusively in mec1-az2 or me-south-1 with no copy elsewhere, and whether regulatory or contractual data-residency obligations even permitted such a copy to leave the jurisdiction. Where they didn’t, AWS’s own multi-AZ guarantees stopped at the region’s edge.