Amazon Web Services said Iranian drone strikes caused structural damage to its data-center infrastructure in the United Arab Emirates and Bahrain, underscoring how cloud computing relies on physical sites and power systems, not just software design.
In a report tied to the strikes, the company said late Monday that two data centers in the UAE were “directly struck,” and it said a Bahrain facility was also damaged after a drone landed nearby. The damage prompted recovery operations that continued into Tuesday, according to AWS updates posted on the company’s online dashboard.
AWS said the attacks disrupted power delivery to its infrastructure and in some cases triggered fire suppression activities that resulted in additional water damage. The company said by late Tuesday that recovery efforts at the UAE sites were making progress.
The AP noted that the damage to three AWS facilities in the Middle East from Iranian drone strikes highlighted the rapid growth of data centers in the region and the industry’s vulnerability to conflict. It also distinguished the incident from previous AWS disruptions that involved software problems causing widespread global outages, saying the new attacks involved physical damage and appeared to have produced localized and limited disruption.
AWS told customers that servers in the Middle East should migrate to other regions and that online traffic should be directed away from the UAE and Bahrain. The company’s guidance reflects a continuity approach that treats disruption at one site or location as something customers may need to plan around.
Cloud resilience, however, does not eliminate all risk, said Mike Chapple, an IT professor at the University of Notre Dame’s Mendoza College of Business. He said Amazon has “generally configured its services so that the loss of a single data center would be relatively unimportant to its operations,” and he described how other data centers in the same zone can take over and usually do so seamlessly to balance workloads.
Chapple cautioned that resilience has limits when multiple facilities are lost. “That said, the loss of multiple data centers within an availability zone could cause serious issues, as things could reach a point where there simply isn’t enough remaining capacity to handle all the work.”
AWS does not typically disclose the exact number of data centers it operates worldwide, but it said its facilities are clustered in 39 geographic regions, with three such regions in the Middle East covering the United Arab Emirates, Bahrain and Israel. AWS said each region is split into at least three availability zones, which it describes as physically separated “by a meaningful distance,” though connected by “ultra-low-latency networks,” and it said it has redundant water, power, telecom and internet connections to maintain operations during emergencies.
The company also describes physical security measures designed to keep out intruders, including security guards, fences, video surveillance and alarm systems. Chapple said those precautions are not aimed at defending against missile attacks, and he characterized the strikes as a reminder that cloud computing is not “magical” and “still requires physical facilities on the ground, which are vulnerable to all sorts of disaster scenarios.”
Chapple said organizations using any cloud provider services in the Middle East should shift computing to other regions as quickly as possible, pointing to the difficulty of hiding large data-center facilities.