In the first week of March, Iranian drones carried out strikes that rattled the US-led technology ecosystem. The drones targeted three Amazon Web Services data centres—two in the UAE and one in Bahrain—marking the first time that major cloud infrastructure anywhere in the world had been physically targeted in a military conflict.
According to the company, the attacks caused “structural damage” and disrupted power delivery to critical infrastructure. AWS said it was working quickly to restore services in the affected areas but cautioned that recovery could take time “given the nature of the physical damage involved.”
For latest news and analyses on Middle East, visit: Yello! Middle East
More importantly, the company advised customers using its services in the region to back up their data and “potentially migrate workloads” to alternative AWS facilities elsewhere in the world. “Customers should enact their disaster recovery plans, recover from remote backups stored in other regions, and update their applications to direct traffic away from the affected regions,” it said.
Historically, “data security” meant protecting systems from hacks. The Iranian strikes, however, demonstrate that the physical location of the cloud itself can be a critical vulnerability.
Notably, between 2021 and 2024, the Gulf states—especially the UAE and Saudi Arabia—attracted some of the world’s largest hyper-scalers with a combination of land concessions, energy subsidies and highly generous tax policies. Several experts now say that when these sites were planned, the possibility of physical risk to such infrastructure was largely absent from the calculations. Iran’s strike appears to have shattered that assumption, exposing the vulnerability of the Gulf’s digital infrastructure and the services built on it.
The Iranians, in effect, appear to be targeting American cloud providers and data centres in the Gulf as extensions of US-linked military infrastructure. Incidentally, the attack has triggered a shift in thinking within the data industry, forcing companies and governments to reconsider the physical security and geopolitical exposure of the infrastructure that underpins the global cloud.
From India’s perspective, the episode is being seen as a wake-up call to classify and harden data centres as critical national infrastructure rather than treat them merely as “real estate” or “commercial warehouses.” Countries like Singapore have already moved towards “critical information infrastructure" designations to protect their digital economies.
Experts say securing such facilities would require steps such as mandating military-grade perimeter defences and integrating them with state police and National Security Guard rapid-response protocols. This would inevitably increase capital expenditure for data-centre operators, but the government could offer “security subsidies” or tax breaks to offset these additional costs.
Some experts also argue that new data-centre approvals should include “geopolitical resilience audits”—assessing a site’s proximity to high-value military targets and its distance from hostile borders—taking into account the increasingly volatile global security environment. India has already begun pushing hybrid models: global cloud services for non-sensitive workloads and sovereign Indian clouds for strategic sectors such as banking, healthcare and government. The current moment may provide an opportunity to accelerate that approach.
The Gulf conflict has also sparked quiet discussions about a possible “data-centre exodus” towards India. Since 2020, more than $14 billion has been committed to data-centre development in the country, with another $20–25 billion expected by 2030. India has several advantages, including relatively lower construction costs and the presence of submarine cable infrastructure connecting the Gulf to Mumbai’s landing stations, which could support such migration discussions.
Nevertheless, India will have to address concerns around power reliability and water stress—both critical for large-scale data-centre operations. Future planning will also need to consider site selection carefully, including the physical proximity of facilities to potential conflict zones in the event of geopolitical tensions with neighbouring states.