Data Centers Are Now Military Targets: What the Iran-AWS Strikes Mean for Global Finance

On March 20, 2026, the world learned a lesson that infrastructure planners had long feared but few had truly planned for: commercial cloud data centers can become collateral damage in kinetic military operations. Three AWS facilities in Bahrain were struck during the ongoing U.S.-Iran conflict, not because they housed military command-and-control systems, but because their physical proximity to military installations made them viable targets under Iran's retaliatory doctrine.

The strikes did not just damage servers. They damaged an entire industry's assumptions about what "resilience" means.

What Happened: The Bahrain Strikes in Context

According to reporting by The Intercept on March 20, corroborated by Reuters and CNBC coverage throughout early March, the strikes targeted facilities in Bahrain's technology corridor that hosted AWS infrastructure. Bahrain has served as a critical node in AWS's Middle East expansion, with the me-south-1 region operational since 2019.

The targeting logic was not random. As Reuters reported on March 3 and March 24, Bahrain hosts the U.S. Navy's Fifth Fleet headquarters and has been a staging ground for American military operations in the Persian Gulf for decades. Iran's retaliatory strikes following the U.S. escalation deliberately blurred the line between military and civilian infrastructure — a tactic that international humanitarian law scholars are still debating.

Three specific consequences emerged immediately:

1. Physical destruction of cloud infrastructure: Three AWS facilities suffered varying degrees of damage, from direct hits to collateral blast effects. Services hosted in these facilities experienced hard outages — not the kind of graceful degradation that multi-AZ architectures are designed to handle.

1. Strait of Hormuz closure: As CNBC reported on March 4, Iran closed the Strait to commercial traffic, affecting not just oil shipments but the submarine cable routes that carry a significant portion of EU-Asia data traffic.

1. Cascading service degradation: Financial institutions that relied on Bahrain as their primary or secondary cloud region found themselves executing disaster recovery plans that had never been tested against a scenario where an entire geographic region becomes simultaneously inaccessible.

Why This Changes Everything for DORA

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) was designed with precisely this type of systemic risk in mind. But the regulation's drafters were thinking about cyberattacks and service outages, not airstrikes. The Gulf strikes force a fundamental reassessment of several DORA provisions.

Concentration Risk Under Article 29

DORA Article 29 requires financial entities to assess concentration risk in their ICT third-party arrangements. The standard analysis focuses on how many institutions depend on the same cloud provider. The Bahrain strikes reveal a deeper dimension: geographic concentration risk that compounds provider concentration risk.

Exit Strategy Requirements Under Article 28

DORA Article 28 mandates that financial entities maintain exit strategies for critical ICT third-party services. For institutions that had placed workloads in Gulf cloud regions, the strikes transformed theoretical exit plans into live execution requirements overnight.

As Fortune reported on March 9, the speed of escalation caught most institutions off guard. Exit strategies that assumed a 30-90 day migration window were useless when the primary region was physically destroyed and the secondary region was unreachable due to cable disruption.

The Testing Gap: Article 26 Scenarios

DORA Article 26 requires threat-led penetration testing (TLPT) for significant financial entities. But TLPT frameworks focus on cyber threats. No standard testing methodology includes "cloud provider's data center is hit by a missile" as a test scenario.

This is not an oversight — it reflects a pre-2026 understanding of the threat landscape. The Gulf strikes have expanded the threat model for operational resilience testing beyond what any regulatory framework currently requires.

The Dual-Use Problem: Military and Commercial Infrastructure

The core issue exposed by the Bahrain strikes is what defense strategists call the "dual-use" problem. Bahrain was attractive to AWS for the same reasons it was attractive to the U.S. military: geographic centrality, stable government, modern infrastructure, and proximity to major markets.

Chris McGuire, former National Security Council director, told The Guardian that "the colocation of military and commercial infrastructure in small Gulf states created a target-rich environment where any strike against military assets would inevitably affect civilian technology."

This is not a new problem in warfare, but it is a new problem for cloud computing. The hyperscalers built their Gulf regions to serve a booming market — Saudi Arabia's Vision 2030, UAE's digital transformation, Bahrain's fintech ambitions. They did not build them to withstand missile strikes.

Sam Winter-Levy of the Carnegie Endowment for International Peace noted that "the weaponization of dual-use infrastructure will be one of the defining features of 21st-century conflict, and the financial sector is uniquely exposed because of its dependence on concentrated cloud infrastructure" (Carnegie, carnegieendowment.org).

What DORA-Regulated Entities Must Do Now

The immediate priority for any DORA-regulated entity with Gulf cloud exposure is a three-phase response: assess, mitigate, and restructure.

Phase 1: Immediate Assessment (0-30 days)

Financial entities must map their complete dependency chain to Gulf-hosted infrastructure. This includes not just primary workloads but ancillary services: DNS resolution, certificate authorities, monitoring endpoints, backup replication targets, and CDN nodes.

The DORA ICT third-party register requirement becomes critical here. Institutions that maintained a comprehensive register of their ICT service providers can answer the question "what is our exposure?" within hours. Those that did not are now discovering dependencies they did not know existed.

Phase 2: Mitigation (30-90 days)

Active workloads must be migrated to regions outside the conflict zone. The challenge is that "outside the conflict zone" is a moving target. As of this writing, the conflict perimeter includes the entire Persian Gulf, the Strait of Hormuz, and potentially the wider Arabian Peninsula.

European-based fallback regions (eu-west, eu-central) offer geographic distance from the conflict but introduce latency for Gulf-based operations. India's Mumbai and Chennai regions are emerging as alternatives, with several institutions already exploring migration paths.

Phase 3: Structural Resilience (90+ days)

The deeper lesson is that no single cloud region — anywhere in the world — should be assumed immune to physical disruption. The ESAs' oversight framework for critical third-party providers must evolve to include geopolitical risk assessment as a standard component.

Financial institutions should adopt a minimum viable sovereignty model: core banking operations must be recoverable from infrastructure that is not dependent on any single geographic chokepoint, cloud provider, or cable route.

The Regulatory Response: What Comes Next

The European Banking Authority and ESMA have not yet issued formal guidance on the Gulf strikes' implications for DORA compliance. However, the ECB's supervisory priorities for 2026-28 already emphasized digital resilience as a top priority — a prescience that now looks understated.

We expect three regulatory developments in the coming months:

1. Updated concentration risk guidance that explicitly incorporates geopolitical and kinetic threat scenarios into the assessment framework.

1. Enhanced exit strategy requirements that mandate tested, time-bound migration capabilities rather than theoretical plans that have never been executed.

1. Expanded TLPT scenarios that include regional infrastructure destruction, not just cyber penetration.

The Gulf strikes have made one thing unambiguously clear: operational resilience is not just about surviving cyberattacks. It is about surviving the full spectrum of threats that modern geopolitics can produce. For financial institutions that built their digital infrastructure on the assumption that data centers are safe from physical attack, that assumption died on March 20, 2026.

Conclusion

The Bahrain strikes are a watershed moment for the financial sector's relationship with cloud infrastructure. They have demonstrated that the line between military targets and commercial infrastructure is thinner than anyone wanted to acknowledge. For DORA-regulated entities, the message is stark: your resilience testing must now account for threats that no cybersecurity framework was designed to address.

The institutions that will navigate this crisis successfully are those that treated DORA's requirements — particularly around concentration risk, exit strategies, and third-party governance — as genuine risk management disciplines rather than compliance checkboxes.

The age of assuming data centers are untouchable is over.

---

Voir aussi: Submarine Cables and the Strait of Hormuz | Multi-AZ Assumptions Challenged | India as Plan B

---

Resume en francais

Le 20 mars 2026, trois installations AWS a Bahrein ont ete frappees lors du conflit americano-iranien, marquant la premiere attaque militaire deliberee contre l'infrastructure d'un fournisseur cloud majeur. Les frappes ont detruit des centres de donnees servant plus de 100 institutions financieres, tandis que la fermeture du detroit d'Ormuz a coupe les routes de cables sous-marins reliant l'Europe a l'Asie. Cet evenement sans precedent remet en cause les hypotheses fondamentales sur la resilience cloud : l'architecture multi-AZ, les strategies de sortie theoriques et les modeles de menace limites aux cyberattaques. Pour les entites reglementees par DORA, les implications sont immediates : revision du risque de concentration (Art. 29), activation des strategies de sortie (Art. 28), et expansion des scenarios de test TLPT pour inclure les menaces cinetiques. L'ere ou les centres de donnees etaient consideres comme intouchables est terminee.