The Cloud Had No Wartime Backup

Amazon Web Services acknowledged on September 15 that it could not restore some customer resources and data after Iranian attacks damaged its facilities in Bahrain and the United Arab Emirates. Data was irretrievably lost in the UAE region’s mec1-az2 availability zone and across all three availability zones in Bahrain. AWS said the destruction exceeded what its regional and multi-availability-zone services were designed to withstand.

The attacks began with Iranian drones on March 1, after US-Israeli strikes on Iran opened the war the previous day. Another strike hit Bahrain on April 1, and an Iranian missile targeted a remaining Bahrain data-center structure on July 24. AWS suspended billing in the affected regions, reportedly issued $150 million in customer credits, urged customers to migrate workloads or restore remote backups, and spent six months trying to recover service. Credits can replace a charge. They cannot reconstruct a database.

The cloud purchase is often understood as an escape from the fragile hard drive under a desk. That image is comforting and incomplete. Customer files still occupy servers, power systems, network links, and buildings within named jurisdictions. Availability zones reduce ordinary equipment failures, but several zones in one region can share the same war.

Availability is not recoverability

AWS owns the facilities and designed the regional architecture, so the scale of this failure belongs in any assessment of its resilience claims. Customers, however, do not all buy the same protection. Some replicate across zones, some across regions, and some keep snapshots or exported copies elsewhere. Others leave a workload in its default location because additional storage, transfers, administration, and recovery tests cost money.

That distinction does not excuse confusing sales language. A service can advertise high durability while leaving geographic replication to an account setting that a small organization never sees or understands. Guarantees may cover uptime or provide credits without promising restoration after physical destruction. Wartime exclusions can narrow contractual responsibility precisely when redundancy matters most.

A usable backup also needs more than copied bits. The organization must retain encryption keys, software versions, database instructions, account credentials, and enough network capacity to retrieve the copy. Egress fees can discourage routine exports. A replica inside the same provider or billing account can disappear behind the same suspension, sanctions problem, compromised login, or unpaid invoice.

Every organization storing medical files, payroll, legal records, research, or public archives should now run one blunt test: produce an independently usable copy outside the provider, country, and billing account. Restore it on different infrastructure, with separate credentials, before an emergency. If that exercise cannot be completed, the organization has purchased storage. It has not yet purchased recovery.