When Drones Hit the Cloud: Physical Risk to Data Centers

Three Facilities, Two Countries, $150 Million

On March 1, 2026, Iranian IRGC drones struck three Amazon Web Services data centers in the UAE and Bahrain. The attacks -- the first known military strikes on a US hyperscaler's infrastructure -- caused structural damage, power disruption, and water damage from fire suppression systems (CNBC).

Two of three availability zones in AWS's UAE region (ME-CENTRAL-1) went offline simultaneously. Standard redundancy models failed because they assume zones fail independently. Amazon issued approximately $150 million in customer credits as services took weeks to fully restore (Yahoo Finance).

The Cascade

The outages hit far beyond Amazon's own operations:

• Banking services went down. Abu Dhabi Commercial Bank, Emirates NBD, and First Abu Dhabi Bank all reported disruptions (CNBC).
• Payments processors froze. Hubpay and Alaan -- payment platforms serving thousands of businesses across the Gulf -- went offline.
• Consumer services stopped. Careem, the region's largest ride-hailing platform, reported outages. Enterprise tools including Snowflake also experienced disruption.
• 92 SaaS platforms reported disruptions tied to the AWS outage in total (StatusGator).

This wasn't a cyber attack. It was kinetic -- drones hitting physical buildings. And the downstream effects were entirely digital.

Why Redundancy Models Broke

Cloud availability zones are designed so that a failure in one zone doesn't take down the others. Customers spread workloads across zones specifically to survive single-zone failures. The March 1 strikes broke that assumption by taking out two zones in the same region simultaneously.

For infrastructure operators who built their disaster recovery plans around multi-zone redundancy within a single cloud region, this event rewrites the risk calculus. Multi-region redundancy -- distributing across geographically separate cloud regions -- is now the minimum viable approach for any workload where downtime costs are measured in millions.

What This Changes

Data centers are now military targets. Iran explicitly claimed the strikes, citing the data centers' role in supporting U.S. military and intelligence networks (Rest of World). Whether or not a given facility serves military customers, the precedent is set. Physical security of cloud infrastructure is no longer a theoretical concern.

Insurance may not cover it. Reports indicate Amazon's insurance did not cover the losses, classifying them as acts of war (Yahoo Finance). Companies relying on cloud providers in conflict-adjacent regions should review their own business interruption coverage for similar exclusions.

Physical risk drives digital consequences. Security teams that separate "physical risk" from "digital risk" into different silos missed this one. A drone is a physical threat. The outage was digital. The teams that saw it coming were monitoring geopolitical escalation, not uptime dashboards. Orion tracks the geopolitical and physical risk conditions -- conflict escalation, military activity, infrastructure threats -- that precede events like these, giving infrastructure teams warning before the blast radius reaches their cloud provider.

What to Do Now

• Audit your cloud region dependencies. If critical workloads run in a single cloud region in a conflict-adjacent geography, you have concentration risk. Map it.
• Review business continuity assumptions. Multi-zone redundancy is not sufficient against correlated physical attacks. Multi-region or multi-cloud architectures reduce the blast radius.
• Check your insurance. War exclusion clauses in business interruption policies may leave you uncovered for exactly this type of event.
• Monitor the physical threat environment. The U.S.-Iran conflict is ongoing. Cloud infrastructure in the Gulf region remains exposed. Track the conditions, not just the uptime dashboards.

Wrapping Up

March 1 proved that a drone can take down a banking system. For infrastructure operators and security teams, the lesson is clear: physical risk and digital risk are the same risk. Request a demo to see how Orion monitors the geopolitical conditions that drive infrastructure disruptions.