The First War to Hit the Cloud

At approximately 4:30 PM Dubai time on March 1, objects struck an AWS data center in the UAE’s ME-CENTRAL-1 region, sparking a fire. The fire department cut power. Within hours, two availability zones were offline, and more than 109 cloud services — EC2, S3, RDS, DynamoDB, and dozens more — were degraded or unavailable. A separate facility in Bahrain’s ME-SOUTH-1 region sustained collateral damage from a nearby drone strike. AWS initially described the cause as “objects” and a “localized power issue.” By March 2, it confirmed what the timing made obvious: these were drone strikes, part of Iran’s retaliatory wave across Gulf states.

Chris McGuire of the Council on Foreign Relations framed the significance plainly: this appears to be the first time a commercial data center has been physically targeted in a military conflict. AWS advised customers to migrate workloads to alternate regions — advice that implicitly concedes the region may remain unstable for the foreseeable future.

The Cascade Was Immediate and Financial

The outage rippled through the Gulf’s digital economy within minutes. Abu Dhabi Commercial Bank and Emirates NBD reported platform failures. Payments companies Alaan and Hubpay went dark. Ride-hailing and delivery platform Careem went offline. Snowflake attributed service disruptions to the underlying AWS failure. Financial institutions relying on the UAE and Bahrain regions for data residency compliance — a requirement that had made the Gulf attractive to cloud providers in the first place — found that regulatory architecture and physical safety architecture were now in direct conflict.

AWS pursued parallel recovery: physical repair of fire-damaged facilities alongside software mitigations to restore partial service. By March 3, S3 writes were functioning, but reads of pre-existing data remained dependent on physical infrastructure repair. The company’s statement acknowledged that recovery required “repair of facilities, cooling and power systems, coordination with local authorities, and careful assessment to ensure the safety of our operators.” Google, Microsoft, and Oracle all operate facilities in the same strike zone. None reported outages — yet.

Insurance Closed the Strait Before Iran Did

The same weekend, a parallel shutdown was unfolding at sea. Between March 1 and March 2, seven of the twelve protection and indemnity clubs in the International Group — which collectively insure about 90 percent of the world’s merchant fleet — issued 72-hour cancellation notices for war risk coverage across the Persian Gulf, the Gulf of Oman, and Iranian territorial waters. The cancellations took effect March 5.

The mechanism is precise and devastating. Without P&I war risk extensions, a vessel’s hull, cargo, and liability coverage is effectively voided in the conflict zone. A tanker worth $100 million that previously paid roughly $200,000 per voyage in war risk premiums now faced quotes of $1 million — if underwriters would quote at all. Many would not. Traffic through the Strait of Hormuz dropped from 22 supertanker transits per day to four on March 1, then effectively to zero by March 2. The IRGC formally confirmed the strait was closed and threatened to set ablaze any vessel attempting passage. But the strait had already been closed — by paperwork, not ordnance.

The Trump administration responded on March 7 with a $20 billion DFC-backed reinsurance facility to cover hull, machinery, and cargo losses. Shipping analysts were skeptical. Insurance is not the binding constraint when vessels are physically being struck by drones. As one Kpler analyst noted, tankers are not moving because their owners are worried about safety, not premiums.

The Structural Lesson Is Architectural

The Center for Strategic and International Studies had warned weeks before the strikes that adversaries in the compute era would target not just pipelines and refineries but data centers, energy infrastructure supporting compute, and fiber chokepoints. That warning is now operational reality. The Middle East was positioned as a growth hub for hyperscale cloud — close to Asian markets, flush with sovereign investment, and eager to host the infrastructure behind AI workloads. The drone that hit mec1-az2 cost less than a luxury sedan. It took down a region that processes transactions for one of the world’s wealthiest financial corridors.

The twin shutdowns — cloud and strait — share a common architecture of fragility. Both systems were designed for a world in which physical security was assumed and risk was financial. Both collapsed not because the underlying infrastructure was destroyed, but because the conditions required for that infrastructure to operate — electrical continuity in one case, insurable risk in the other — were withdrawn by forces outside the system’s control. The question now is not whether these systems can be repaired. It is whether they can be redesigned for a world in which drones and cancellation notices are instruments of war.