AWS lost customer data in Bahrain for good - three zones turned out to be one address

"The cloud" sounds like something that is everywhere and nowhere. Then, as Lukasz Olejnik, a Polish cybersecurity researcher and former cyberwarfare advisor at the International Committee of the Red Cross, put it in a post on X: "Turns out the cloud has a street address, and it was within drone range."

On Tuesday, September 15, AWS, the world's largest cloud provider, added two updates to its status page. In Bahrain the company is "unable to restore access to the resources and data hosted exclusively in this Region." In the UAE the same applies to one of three zones - mec1-az2. Reuters reported it first. It is most likely the first time that warfare has permanently erased a piece of a global cloud.

How did it come to this? In late February the U.S. and Israel attacked Iran, and Iran answered with strikes on the Gulf states. On Sunday, March 1, the first AWS data center in the UAE was hit by what the company called "objects": fire, power cut. A day later a second zone in the UAE went down, also after a direct hit, along with the first one in Bahrain, damaged by a drone strike close by. Putting out the fires added water damage. Bahrain is home to the U.S. Fifth Fleet. In April a second zone there went down and the whole region stopped working. In July Iran's Revolutionary Guard announced it had destroyed "the remaining structure" of the Amazon facility. In AWS's updates the word "Iran" does not appear once.

Everything the company has said publicly about this comes down to 38 entries on the status page, with a gap from April 30 to September 15. No blog post, no press release and, so far, no post-event summary of the kind AWS publishes after major incidents (formally the event is still open). The company has not said how much data was lost or how many customers are affected. It only says that "most" managed to move in time. The Register asked for comment and was told AWS had nothing to add.

And the famous eleven nines? According to AWS, S3 is designed to provide 99.999999999 percent durability. Except that number covers a single region and accounts for the loss of at most one zone. Per the documentation, zones are separated by "many kilometers," but all are within 100 km (60 miles) of each other. For a power outage, those are three independent places. For a missile, they are one target. Olejnik put it this way: "Multi-AZ protects from a fire in one building, not from a war." AWS described it itself on March 2: after the first zone was lost S3 "continued to operate normally," and when the second one went down, the errors began. The documentation also says plainly that objects "never leave that Region, unless you explicitly transfer them to another Region."

The contract leaves no illusions either. Backups are the customer's job. AWS is not liable for "the value of your content," total liability is capped at what you paid in the previous 12 months, and the force majeure list includes war. The SLAs cover service availability only; they say nothing about data durability. Publicly AWS has promised one thing: billing is suspended in both regions. According to a Forbes report, customers also received about $150 million in service credits after the March strikes.

It is easy to say they had it coming, because who doesn't keep a copy somewhere else? Except that in Bahrain, according to an anonymous vendor on Hacker News who operated there, "nobody is storing data in Bahrain unless there are data residency requirements for it." The warnings from AWS kept coming, but his company was "contractually and legally forbidden" to copy even encrypted data out of the country. "The best we could do was tell our subcustomers to download all of their buckets to their office or some employee laptops at their office." A second commenter, whose customers ran in Bahrain, writes that after the first zone was lost his company wanted to move the data out, even just as cold backups, but the legal department "slapped that down pretty quickly." Early in the conflict the UAE central bank temporarily relaxed its requirement to keep banking data in the country, The Banker reported.

The most commented post in the Hacker News thread is a quote from 2017. CBS correspondent David Pogue asked Matt Wood of AWS what would happen if someone blew up one of the company's data centers. Wood laughed: "Yeah, you wouldn't notice. I mean, we might be a bit upset, but you wouldn't notice!" In another branch of the thread Danny O'Brien, a former director at the Electronic Frontier Foundation, wrote that back in the 2010s he tried to explain to lawmakers that geographical redundancy "was a good thing, actually." In his view, instead of asking which country the data sits in, they should have been asking who holds the encryption keys and the administrative access.

Why does this matter in the U.S.? Because here nothing stops you. AWS runs several regions across the country, from Northern Virginia and Ohio to Oregon and Northern California, no law keeps a typical company from copying its data between them, and yet cross-region replication is still something you have to turn on and pay for yourself. Many teams never do, and everything they own sits in a single region. Europe, meanwhile, talks more and more about data sovereignty, about keeping data at home. In Bahrain, the data that was lost was precisely the data the law would not let leave.

Don't count on the courts either. After the fire at OVH's data center in Strasbourg in 2021, a court in Lille awarded about 100,000 euros to a company that had been paying for automatic backups. The backup sat in the same building as the server and was lost with it. In 2025 an appeals court cut that to 1,800 euros, because the contract never promised the backup would be anywhere else. So ask your provider one thing today: where does my backup physically sit? If it's at the same address as the original, it's not a backup.

Region - in AWS, a group of data centers in one area, split into at least three availability zones, each with its own power and network links. S3 - AWS's file storage service. SLA - service level agreement, a guarantee usually expressed as the percentage of time a service will be available. Data residency - a legal requirement that data physically stays within a given country.