Cloud Vulnerabilities Exposed by Iranian Drone Attacks: Why Data Replication Alone Was Not Enough

The belief that storing data in the cloud is safe because it is separated from physical space is being shaken. In the early hours of March 1, 2026, an attack by Iranian kamikaze drones caused damage to Amazon Web Services (AWS) data centers in the Middle East, resulting in cases where some data could not be recovered despite being replicated in multiple locations.

The situation at the time was extremely urgent. Drones struck two AWS data centers located in the UAE, causing fires, and fire authorities had to shut down all building power and emergency generators to suppress the flames. In this process, fire suppression systems were activated, leading to flooding damage as some equipment was soaked in water. The problem was that customer data was contained within this equipment. While the cloud feels as if data is floating in the sky, it is actually recorded on physical storage devices such as hard disks or SSDs inside data centers; if the equipment is destroyed, data without a copy disappears along with it.

According to a video by Unrealscience, the core of this incident lies in the fact that the 'assumption of independence,' which is the foundation of cloud design, was broken by the variable of war. Typical cloud design sets the probability of a single Availability Zone (AZ) failing to be very low and assumes that each AZ operates independently. For example, if three AZs each have a 0.1% probability of failure, the probability of all three stopping simultaneously is theoretically only one in a billion. However, this calculation only holds true when the failure of each AZ has no effect on the others.

However, disasters such as war cause 'Common Cause Failure.' The video explains, "If the same military repeatedly attacks facilities in one region, the possibility that other AZs will also be attacked increases when one AZ is damaged." In fact, the AWS data centers in the UAE resulted in the inability to recover data stored in some Availability Zones (AZ) due to the combination of fires from drone attacks, power shutdowns to suppress those fires, and flooding from the activation of fire suppression systems. Specifically, AWS announced that they could not ultimately recover certain resources and data that were stored only in a specific availability zone called 'MEC One, AZ Two' in the UAE. The Bahrain region also became entirely unusable as damage continued across multiple AZs.

Questions remain as to whether the damage could have been prevented if data had been replicated to other regions. AWS's service method varies depending on the type of data. 'Amazon S3 Standard,' which stores files like photos or documents, creates multiple copies of files and distributes them across at least three separate AZs. On the other hand, 'EBS,' which is in the form of hard disks or SSDs used by connecting to a server, basically keeps copies only within the same AZ. Therefore, to prepare for a situation where an entire AZ stops, one must separately create 'snapshots' that are stored across different AZs within the region.

While it is possible to replicate data to regions further away, the video points out two realistic constraints. First is the issue of cost and management. AWS does not automatically copy data to other regions; instead, customers must directly configure the backup method and bear the additional costs associated with it. Second is the data regulation of each country. In countries like the UAE or Bahrain, the overseas transfer of sensitive information, such as medical, financial, and government data, is strictly limited by law. For example, the UAE strictly limits the overseas transfer of medical data, and sector-specific regulations apply to financial or government data as well. These regulations act as factors that make it difficult for companies to design services to immediately shift to overseas regions in the event of a failure. At the time, the only AWS regions in the Gulf region were Bahrain and the UAE, and the Saudi Arabia region was set to open in December 2026, leaving limited options.

This incident clearly revealed the physical vulnerabilities of data centers. Data centers are large buildings fixed in specific locations, making it difficult to hide their location, and they are asymmetric targets that can be sufficiently struck even with inexpensive weapons like drones or missiles. An Iranian border media outlet even reported that the Islamic Revolutionary Guard Corps attacked the AWS facilities because they judged them to be supporting enemy military intelligence activities. Furthermore, due to the massive power required for server operation and heat management issues, there are structural limitations where servers must lower their output or shut down if power supply or cooling systems are paralyzed. Even if there are Uninterruptible Power Supplies (UPS) and emergency generators to prepare for power outages, if the cooling function is lost, servers must stop operating to prevent overheating and equipment damage.

National strategies to respond to this are also being discussed. The UAE is considering a plan to modify its existing centralized data center construction plans by dispersing facilities across multiple regions. In the plan to create a 5-gigawatt AI data center complex in Abu Dhabi, they aim to disperse the facilities so that even if one location is attacked, the entire system does not stop. In addition to physical defenses such as utilizing mountainous terrain or introducing interception equipment and explosion-resistant concrete, an alternative is proposed to back up core national data overseas (to places like Luxembourg, etc.) through a 'Data Embassy,' as Estonia does. Through an agreement in 2017, Estonia stores core data such as the resident register and land registry in Luxembourg, which receives immunity and protection equivalent to an actual embassy.

Past cases in Ukraine demonstrate the importance of data protection. Ahead of the 2022 Russian invasion, Ukraine passed a cloud service law to establish a foundation for public institutions to use the cloud. On the day of the invasion, utilizing 'Snowball' equipment capable of moving large volumes of data, they succeeded in moving more than 10 petabytes of essential data from 42 government agencies, 24 universities, and others to the AWS cloud by June of that year. Ultimately, data security in the cloud era is expanding beyond simply increasing the number of copies to the question of 'where and how to store it by physically isolating it.'