AWS says some Middle East customer data is permanently lost after attacks

The loss exposes limits of regional redundancy and widens scrutiny of how AWS markets resilience versus what customers must build themselves.

AWS has confirmed it cannot recover customer data that existed only in the damaged Middle East (UAE me-central-1 and Bahrain me-south-1) infrastructure, because the physical destruction exceeded what its regional and multi‑AZ designs cover. In UAE, all data stored solely in availability zone mec1-az2 is unrecoverable, while in Bahrain the entire me-south-1 region is affected, despite AWS previously advising customers to replicate and then migrate workloads out of those regions after Iranian drone strikes. This outcome has triggered debate among engineers about the gap between AWS’s marketing‑level promises of seamless redundancy and the documented requirement that customers design and pay for cross‑region resilience themselves. AWS documentation and certification materials emphasize the shared responsibility model and recommend cross‑region backups, but many teams and executives reportedly assumed “using AWS” alone implied protection from catastrophic regional loss. The incident also exposes a hard conflict between legal data residency requirements that keep data within national borders and the need for cross‑border replication to survive a full regional failure.