Skip to content

Build2 publishers2 min readPublished

AWS has written off the customer data that lived only in its Bahrain region

Six months after strikes damaged facilities in Bahrain and the UAE, AWS says resources held only in Bahrain cannot be restored. Its resiliency guidance leaves cross-region copies to the customer to configure.

The Engineer · Build desk

Photograph accompanying AWS has written off the customer data that lived only in its Bahrain region
Photo: thenationalnews.com

What happened

  • AWS said on September 15th that it cannot restore access to resources and data held exclusively in its Bahrain region, six months after drone strikes damaged cloud facilities in Bahrain and the UAE.
  • In the UAE region, AWS has restored access to the mec1-az2 availability zone and still cannot reach the az1 and az3 zones, according to The Stack.
  • AWS told Bahrain customers to move workloads to other regions, then used backups where they existed and tried alternative recovery methods before saying it had exhausted its options.
  • The company has not attached a customer count, a data volume or a financial estimate to the damage.
  • AWS says recovery work continues on two affected UAE zones and that it expects to issue its next public update on Bahrain in early 2027.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

  • constraint A bank or government tenant held to in-country storage cannot take AWS's cross-region advice without breaking the residency rule, so choosing one region is also accepting that a region-wide event is a total loss.
  • exposure Because the resiliency guidance assigns backups, replication and multi-zone deployment to the customer, the unrecoverable data sits on the tenant's books, not the provider's.
  • decision Anyone whose only copy sits in a single region now has a dated case to put in front of the budget owner who ruled cross-region duplication excessive.
  • contradiction The two published accounts of the UAE do not agree: the CNBC-based report has one zone unrecoverable with work continuing on two others, while The Stack has one zone back and two unreachable, so a UAE tenant cannot tell from the record which case applies to its zone.

An availability zone, in AWS's own documentation, is one or more discrete data centers inside a region, and that documentation lists three zones in Bahrain and three in the UAE [8]. The structure exists to contain localized equipment failures, power problems and natural disasters [9]. What hit it was several facilities in one geographic area: two UAE data centers struck directly, and a nearby strike that damaged infrastructure in Bahrain [10]. Structural damage and power disruption followed, along with water damage caused by fire-suppression work, according to the Associated Press [11]. The Stack described the attacks as Iranian strikes [20].

"The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand," AWS said in its Bahrain update [12]. Multi-AZ deployment buys uptime through the loss of a data center. The loss of a metropolitan area is past what it covers. For an event that disables an entire region AWS recommends cross-region recovery, and its resiliency guidance leaves backups, replication and multi-zone deployment for the customer to configure [13].

Some customers moved data out of Bahrain after the March attacks, and a second disruption in April took the region out entirely; The Stack wrote that customers who moved slowly are out of luck [5]. The gap between the two events was a matter of weeks [22]. A plan whose first step is to copy the estate elsewhere once the notice arrives has to run at full data volume over a damaged region's remaining capacity, while every other tenant is trying to do the same thing.

The Bahrain region opened in July 2019 with three availability zones, and the UAE region in August 2022 with three [21]. Cross-region copies add cost, operational work and data-governance questions, and a startup can reasonably decide duplicate infrastructure elsewhere is excessive for an unlikely regional event [15]. Regulated tenants have the reverse problem: banks, governments and others may be required to keep data locally, which leaves fewer options for geographic separation [14]. For those customers the cross-region recommendation and the residency rule cannot both be satisfied inside one country's footprint.

Amazon reported $128.7 billion in AWS sales and $45.6 billion in AWS operating income for 2025, against $80 billion in operating income across Amazon [16], so roughly 57 percent of the company's operating income came from the cloud division [17]. A regional loss of undisclosed size does not move that. The September post was AWS's first public account of the recovery effort since April, about five months earlier [18][19].

What to watch

  • Whether the early 2027 Bahrain update revises the unable-to-restore finding or finally attaches a data volume to it.
  • Whether az1 and az3 in the UAE are restored or join Bahrain in the unrecoverable column.
  • Whether any regulated Gulf customer discloses a loss, and whether in-country-only residency rules are revisited as a result.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories