AWS Cannot Restore Gulf Data Locked In by Residency

Amazon Web Services said on September 15 it cannot restore customer data kept only in its Bahrain region and in one United Arab Emirates availability zone. Iranian drones hit those sites in March, and the leftover copies are the ones that never left the country.

Most customers had already rebuilt in other regions. The files that stayed behind to satisfy local law are the ones AWS now says it cannot reach.

Exclusive Copies in Bahrain and One UAE Zone Are Gone

The note went up on the AWS Health Dashboard at 10:22 a.m. UTC on September 15, the first public status post in five months. It covers two different failures, and they are not the same size.

THE SEPTEMBER 15 FINDING

• Bahrain: AWS cannot restore access to resources and data hosted exclusively in the Middle East (Bahrain) region, code me-south-1.
• UAE write-off: It cannot restore access to resources and data hosted exclusively in availability zone mec1-az2.
• UAE still open: Recovery work continues on zonal resources in mec1-az1 and mec1-az3, plus wider regional services.
• Next notes: An update on the UAE is due in the coming months. A further Bahrain update is due in early 2027.

AWS said it has notified the relevant authorities in both countries and that support teams remain available to help customers move applications. It did not say how many customers still had data only in those places, or how much data that is.

Why Some AWS Gulf Data Cannot Be Restored

The March hits did not take down a single hall. In the UAE, two facilities were struck directly. In Bahrain, a drone exploding close to one site still wrecked power, structure, and kit. Fire crews then soaked equipment that the blasts had not already ruined.

The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand.

Amazon Web Services, Health Dashboard, September 15, 2026

After a thorough assessment, AWS wrote, it had exhausted every option for restoring Bahrain data and resources that had not been migrated before the region went dark. The same verdict now applies to anything that lived only in mec1-az2. Access is the word the company used. It did not publish a disk-by-disk inventory of what burned, what flooded, and what still sits behind a dead door.

That is a narrower finding than a whole-country blackout. The UAE region, me-central-1, still has two zones in recovery. Bahrain is the total loss: exclusive copies in that region are out of reach.

Multi-AZ Design Stops at One Lost Zone

AWS sells a region as three availability zones, each one or more data centers with its own power and network. Standard Amazon S3 classes store objects across a minimum of three zones and are designed to survive a full zone loss. The durability target is 99.999999999% of objects over a year. Availability is a separate figure, 99.99%.

Those zones sit many kilometers apart, and all of them sit within 100 km (60 miles) of each other. That spacing is close enough for a drone campaign against one small country to bruise more than one zone in the same week. It is also the spacing S3 needs for synchronous copies. The design assumes a building can die. It does not assume two zones in the same kingdom die in the same war.

WHERE THE TWO GULF REGIONS STAND

On March 3, AWS said it was pushing software workarounds for S3 and DynamoDB so those services could run inside the damaged footprint, because so many other products sit on top of them. By April 30 the Bahrain region was simply marked unavailable, with billing paused while restoration was expected to take several months. September 15 is the admission that several months were not enough for the copies that never left.

The Law That Kept Copies Inside the Same Country

On March 3 AWS told customers to enact disaster recovery plans, restore from remote backups, and point traffic away from the affected regions. For alternate sites it named the United States, Europe, or Asia Pacific, “as appropriate for your latency and data residency requirements.” That last clause is the whole problem.

Mark Scott, executive director of risk management at j. awan and partners, wrote that several GCC banks saw mobile and phone banking stutter within hours of the March 1 strikes. Payments firms and consumer platforms in the UAE went down with them. Mohamed Radwan, a senior cloud architect at T-Systems International, told that same review that residency is the law. Moving a regulated workload to Virginia or Frankfurt in a panic can put personal and financial records outside national borders.

THE RULES THAT KEPT DATA IN RANGE OF THE STRIKES

• Bahrain PDPL: Law No. 30 of 2018 limits transfers of personal data outside the kingdom unless the destination offers sufficient protection, or a specific approval is in place.
• CBB licensees: Banks, payments firms, and insurers under the Central Bank of Bahrain treat in-country or approved GCC hosting as the default path, with tested recovery plans that still have to respect location rules.
• UAE PDPL: Federal rules prefer in-country processing. For many government-adjacent and banking workloads, me-central-1 is the region that keeps the data inside the UAE.
• In-country DR: Teams that wanted a spare copy without leaving the Gulf often paired Bahrain and the UAE. Both regions were hit in the same campaign.

On November 4, 2025, e& and AWS put the UAE Sovereign Launchpad into commercial service, hosted in the AWS Middle East (UAE) region and endorsed by the UAE Cybersecurity Council. It was built so government and regulated industries could run almost every workload short of Secret and Top Secret with data staying in the country. Four months later, two of that region’s three zones were badly impaired.

Gulf operators who run these regions for a living already treat me-south-1 as a write-off. The sharper failure is the lawful spare copy that sat a short flight away in the other GCC region, then went dark in the same war.

Bahrain’s Government Already Lived on That Region

Bahrain opened the first AWS region in the Middle East in 2019, with three availability zones inside the country. The UAE region followed in August 2022, also with three zones. For years the pitch was local storage with global tools, and Bahrain’s government took it further than anyone else in the neighborhood.

In 2017 the kingdom issued a Cloud First Policy and became the first country in the Middle East and Africa to mandate cloud over on-premise kit for government work. An AWS public-sector post in April 2025, co-written by Dr. Khalid Ahmed Al Mutawah, deputy chief executive of operations and governance at the Information and eGovernment Authority, said 85 percent of government workloads sat in the cloud. The Cloud Transformation Program had moved 72 government entities, more than 1,385 government services, and 570 e-services.

That figure is exposure, not a casualty count. AWS said that when the first Bahrain zone was damaged in March, it began telling customers to leave, and that most did so before a second zone failed in April. Remaining customers were then helped to rebuild elsewhere with backups where those existed, or with other workarounds. What the company cannot restore is the slice that was still exclusive to the region when the lights went out. It has not said whether any of that slice belongs to the state.

The Islamic Revolutionary Guard Corps said the Bahrain facilities were struck because of Amazon’s support for US military operations. AWS’s own March 3 note stuck to physical facts: structural damage, broken power, and water from fire suppression.

March Damage, an April Blackout, Then a Long Gap

The United States and Israel opened their offensive against Iran on February 28. The drones followed a day later. AWS’s public incident clock for Bahrain starts on March 2 at 5:56 a.m. UTC.

THE MONTHS FROM THE FIRST DRONE TO THE WRITE-OFF

1. February 28, 2026: The United States and Israel begin their offensive against Iran.
2. March 1, 2026: Iranian drones hit Gulf targets. AWS later says two of its UAE facilities take direct strikes and a nearby blast damages a Bahrain site, with fire and suppression water adding to the wreckage.
3. March 2, 2026: The public Health Dashboard event for me-south-1 opens at 5:56 a.m. UTC. Early notes focus on mes1-az2 and restoring power.
4. March 3, 2026: AWS confirms physical impacts in both regions, names elevated errors on EC2, S3, DynamoDB, Lambda, Kinesis, CloudWatch, RDS, and the console, and tells customers to copy data out.
5. April 2026: A second Bahrain availability zone is disrupted. The region becomes unavailable. Most customers who could move have already moved.
6. April 30, 2026: AWS says me-south-1 is unavailable, suspends relevant billing, and tells customers to recover from remote backups. Restoration is expected to take several months.
7. September 15, 2026: AWS says exclusive Bahrain-region data and exclusive mec1-az2 data cannot be restored. UAE work continues. Bahrain’s next public note is set for early 2027.

More than six months sit between the first strikes and that write-off. In the gap, AWS went quiet on the public dashboard and said it would talk to affected customers through the Personal Health Dashboard instead. Tuesday’s post is the first time the company has said, in public, that some exclusive copies are beyond it.

Saudi Arabia’s New Region Still Faces the Same Rule

AWS is still building in the Gulf. A Saudi cloud region due in December is on track, AWS said at LEAP in Riyadh, on more than $5.3 billion (19.88 billion riyal) of planned investment, with up to 50 MW of capacity in a first AI Zone by 2028 in a partnership with HUMAIN. UAE officials have talked about spreading future halls across several emirates, putting some of them underground, and parking drone defenses next to the racks.

Those projects will still have to decide where the spare copy lives. A second hall in the same country keeps the regulator happy and keeps both copies inside the same campaign. A copy in Europe or the United States may survive the next swarm and break the residency rule that made the local region worth opening.

AWS has promised to keep supporting customers in Bahrain and the UAE, to replace damaged kit in the Emirates, and to speak again on Bahrain in early 2027. Until a customer can keep a lawful copy far enough away to outlive a multi-zone strike, exclusive data in a Gulf region remains a single room with three doors, all of them in range.