Missile strike damaged Amazon’s Bahrain data centers; cloud service and billing suspended

The pictures arrived four months late. On July 28, Bloomberg published satellite images showing damage at two Amazon data centers in Bahrain, one near Zallaq and one near Askar, corroborating a claim by Iran’s Revolutionary Guard Corps from days earlier that its missiles had destroyed the sites.

Gizmodo reported on July 28 that lower-resolution frames from the European Space Agency's Sentinel-2 constellation show the same scarring. Amazon, the world’s largest cloud operator, took a direct state-on-state military hit but has not publicly confirmed it.

The confirmation came not from photographs but from company updates. The AWS service dashboard posted an April 30 update stating that the UAE and Bahrain regions "suffered damage as a result of the conflict in the Middle East" and could not support customer applications, with repairs expected to take several months. Ars Technica reported the update on May 1. The same update suspended billing in both regions.

Ars Technica's May 1 reporting also noted that Amazon had already waived all usage charges for March at an estimated cost of $150 million. An internal document obtained by Business Insider described fourteen EC2 server racks knocked offline at one site, five more affected, flooding from fire-suppression systems, and failed cooling.

Iran’s Revolutionary Guard wants American power in the Gulf degraded without striking American soil. So it hit buildings housing Pentagon logistics and intelligence processing. AWS hosts CENTCOM systems across the Gulf, and the CIA’s classified cloud contract splits workloads among Amazon, Microsoft, Google, Oracle and IBM through these facilities, according to Shatterbelt analysis on March 26.

Amazon wants the Pentagon contracts worth billions and the Gulf consumer market too. Until February, those goals did not conflict. Bahrain and the UAE want to be the digital capitals of the region; their sovereign wealth funds financed the buildout. The Gulf customer, from Dubai ride-hailing app Careem to regional banks, just wanted the ninety-nine point nine nine percent uptime promised in contracts.

The slow pressure

July’s missile salvo was the trigger, but the slow pressure underneath is five years of concentration. Two AWS regions in the Gulf, one Azure region in the UAE, and one Google region in Doha were built for latency and tax advantage inside Iranian missile range, all sharing power grids, desalinated cooling water, and submarine cable landings, according to Shatterbelt analysis on March 26.

Greymantle Risk Advisory noted on March 23 that seventeen submarine cables run through the Red Sea, carrying most traffic between Europe, Asia, and Africa, and Iran closed the Strait of Hormuz during the same weeks. Both of the world’s data corridors sat in an active conflict zone.

Ars Technica reported on May 1 that the war began on February 28 with American and Israeli strikes on Iran. The first drone hits on Amazon facilities followed within days. Shatterbelt's March 26 analysis records Iran striking the Bahrain facility again on March 24, twenty-four days after the first hit.

In 1999, NATO bombed the Radiotelevizija headquarters in Belgrade, a civilian broadcast building that also carried state command communications, killing sixteen staff inside.

When a building serves both commerce and command, the military treats the second use as the only one that matters, and the civilians sharing the roof pay first.

Scale and ownership are new this time. State television belonged to the state it fought for; Amazon belongs to shareholders. Shatterbelt analysis on March 26 notes that Iran published a list on March 11 naming Google, Microsoft, Palantir, IBM, Nvidia, and Oracle as potential targets. A state army put American companies on a target board; that had no precedent.

States have always spared the financial and communications infrastructure both sides need. Even at Cold War heights, nobody bombed SWIFT or transatlantic cables, mutual hostage-taking kept the wires up. Iran may be making the same calculation in reverse—hitting Amazon hard enough to signal, leaving Gulf banking rails repairable.

That is roughly what happened. Shatterbelt’s analysis on March 26 records ATMs and payment systems freezing across the UAE after the March strikes, then coming back. If Tehran’s goal were paralysis, the damage would look worse than the imagery shows. Iran pricing Amazon’s presence, not erasing it, fits the evidence better.

Who pays

Amazon pays twice: the $150 million in waived charges already booked, then months of unbilled capacity while buildings are rebuilt. The recovery window is long enough that the company itself told customers to migrate out of the regions permanently, according to Ars Technica's May 1 report. Careem moved overnight to other data centers and survived, per the same reporting.

Customers who failed to configure backups in a second country did not. Their business-interruption policies almost certainly exclude acts of war, the standard exclusion that Lloyd’s and large reinsurers are now re-examining for Gulf digital assets, per Shatterbelt’s March 26 analysis. London-based developer Pure Data Centre Group has paused Middle East investment until the conflict subsides, according to Ars Technica on May 1—the first visible defection from the Gulf buildout. The profits migrate with the workloads, to Ireland, Frankfurt, and Singapore data centers whose landlords never appear in missile trajectory analysis.

Sam Winter-Levy of the Carnegie Endowment called the strikes "a harbinger of what's to come" in the Financial Times (Financial Times, via Greymantle, Mar 23). Once one belligerent treats commercial cloud as a military target, every military must assume its own contractors' buildings are targeted, and every cloud buyer must assume the region chosen for latency can go dark for half a year without an insurance check. That assumption reprices data centers everywhere, not just in the Gulf.

If AWS extends its suspension beyond summer, if other hyperscalers stop quoting new Gulf capacity, and if Gulf sovereign funds demand hardened, dispersed facilities to host, the migration is permanent. What breaks it: a fast, fully billed restoration of both regions, fresh Gulf capacity commitments from Microsoft or Google, and customers moving back. That would mean the March and July strikes were a spike, not a regime change, and the Gulf stays the region's digital capital.

The consequence lands on people with names and addresses. A Bahraini operations engineer keeping a dead building cool enough not to corrode.

A Dubai founder watching a company die because its database lived in one zone; a claims adjuster reading a war exclusion aloud to a client who thought the cloud meant nowhere. The cloud always had an address. Now it has a blast radius.