AWS says Bahrain data is gone: multi-AZ is not a backup

There is a sentence no cloud provider wants to publish, and AWS published it on September 15: some customer data is not coming back. Six months after drone strikes damaged its Middle East facilities, AWS told customers it cannot restore resources and data held exclusively in the Bahrain region, or in one availability zone in the UAE. If your disaster recovery plan says "multi-AZ," this is the week to go read what that actually buys you.

What actually happened

In March 2026, drone attacks during the conflict with Iran hit AWS infrastructure in both countries. Two UAE facilities were struck directly; a Bahrain facility took damage from a nearby strike. Buildings, power equipment and supporting infrastructure were damaged, and fire suppression added water damage on top.

The September 15 update to the AWS Health Dashboard is the part that matters. In Bahrain, the damage spanned multiple availability zones — and AWS said it exceeded what its regional and multi-AZ services are designed to withstand. After investigation, the company concluded it can no longer restore access to resources and data stored exclusively in that region.

The UAE picture is narrower. Data hosted exclusively in mec1-az2 is unrecoverable. Work continues on regional resources and on the other two zones, mec1-az1 and mec1-az3.

Why it matters for your business

Multi-AZ is sold as redundancy, and it is — against the failure modes it was designed for. A rack fails, a transformer blows, a zone loses power, and your traffic moves to a sibling zone a few kilometers away. That design assumption is that failures are local and independent.

War is neither. Bahrain is the demonstration that separate buildings inside one region can share a blast radius, and when they do, every copy you thought you had was one copy in three places. That is a correlated-failure problem, and it is not specific to AWS or to the Middle East. Substitute a regional grid failure, a flood plain, or a government action and the shape is identical.

So check three things this week, and be specific about it:

Where your backups physically are. RDS automated backups and snapshots stay in-region by default. So do most EBS snapshots. Cross-region copy is a setting somebody has to turn on, and in a lot of accounts nobody did. S3 Cross-Region Replication is likewise opt-in per bucket.

Whether your SaaS vendors tell you. Your CRM, your ticketing tool, your e-commerce platform — each one picked a region for you. Most will name it if you ask. "Multi-AZ within one region" is the common answer, and you now know what that covers.

Whether you hold a copy outside the provider. Not a second AWS region — a copy at a different provider or on hardware you control. For a small business that is usually a nightly export of the database and the object store to somewhere else entirely. It is unglamorous and it costs very little.

None of this is a reason to leave the cloud. It is a reason to stop treating a provider's default resiliency posture as your disaster recovery plan. Those were never the same document.

Sources: CNBC, Techzine.