At 4:30 AM on March 1, objects struck an Amazon Web Services data center in the Dubai industrial zone, creating sparks and fire. Those are not my words. Those are the exact words from the AWS Health Dashboard, the official status page that is the only communication Amazon has issued about the first military attack on commercial cloud infrastructure in history.

Two AWS facilities were directly hit in the UAE. A third in Bahrain was damaged by a nearby strike. AWS described recovery as “prolonged” due to structural damage, power disruption, and water damage from fire suppression. As of March 3, full functionality had not been restored. Customers were advised to migrate workloads to other regions.

A Shahed drone costs Iran roughly $20,000 to produce.

The AWS ME-CENTRAL-1 region in the UAE processes financial transactions for banks across the Gulf. It runs ride-hailing platforms, payment systems, and government services. It stores data for enterprises that chose Dubai precisely because it was stable, connected, and growing. The entire value proposition of Gulf cloud infrastructure rested on an assumption identical to the one that governed Dubai’s airport, its gold trade, and its real estate market: the Gulf would never become a sustained combat theater between major military powers.

That assumption is burning alongside the servers.

AWS multi-availability-zone architecture prevented a global outage. Traffic shifted automatically to unaffected zones and other regions. Customers running multi-zone deployments experienced minimal disruption. The system worked as designed at the software layer. But software failover cannot repair a building that has been physically struck by a drone. The damaged availability zone requires structural reconstruction, power restoration, and equipment replacement on timelines measured in weeks, not hours. A 99.99 percent uptime SLA means nothing when the data center has a hole in it.

Iranian state media claimed the strikes were deliberate targeting of American technological infrastructure. Whether the IRGC specifically selected AWS facilities or whether the data centers were collateral damage from strikes on nearby industrial targets is unresolved. The distinction matters legally. It does not matter operationally. The building is damaged either way.

What matters strategically is this: every hyperscale cloud provider with Gulf infrastructure just learned that their physical assets sit within the engagement envelope of a $20,000 loitering munition launched from a truck. Google Cloud, Microsoft Azure, Oracle, and every enterprise that colocates in the region are recalculating. The cloud was supposed to be abstract. Distributed. Resilient. It turns out the cloud has a physical address, a concrete floor, a power connection, and a GPS coordinate that a drone can reach.

Amazon has not issued a press release. No executive statement. No blog post. Only the health dashboard, written in the careful, technical language of an engineering team documenting physical destruction as though it were a service degradation event. “Objects that struck the data center, creating sparks and fire.” That is the most consequential understatement in the history of cloud computing.

The cloud is not in the sky. The cloud is in a building. And the building is in a war zone.