Iran's Drones Didn't Stop the Gulf's AI Boom. They Changed How It Gets Built.

Two things in this story rest on Iran’s word: a $2 trillion valuation nobody has audited, and a July missile strike on Amazon in Bahrain that satellite images appear to support but Amazon has not confirmed. We mark both where they appear.

The region that didn’t come back

On September 15, at 3:22 in the morning Pacific time, Amazon Web Services posted an update on its cloud region in Bahrain. The sentence that mattered: “After a thorough assessment, we have determined that we are unable to restore access to the resources and data hosted exclusively in this Region.”

Five minutes later came a second post, about the UAE. AWS said it was “unable to restore access to the resources and data hosted exclusively in mec1-az2,” one of the three zones in its UAE region.

AWS builds each region from several Availability Zones, which Reuters describes as clusters of one or more data centers, so that one can fail without taking the region down. Its September post said what happened when more than one did: “The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand.”

That is what sits under Iran’s new threats. The damage they point to happened in March, and some of it cannot be undone. So far, the money behind the Gulf’s AI build-out has not left. What has changed is how the region builds: more sites, more concrete, more defenses, more cost, and a risk that standard insurance will not carry.

The war began February 28 with U.S.-Israeli strikes on Iran, the war our July series covered. On March 2, AWS described the hits: “In the UAE, two of our facilities were directly struck, while in Bahrain, a drone strike in close proximity to one of our facilities caused physical impacts to our infrastructure.” It listed “structural damage, disrupted power delivery” and “fire suppression activities that resulted in additional water damage.” AWS’s own posts say “drone strike” and do not name Iran. Iran’s Revolutionary Guards claimed responsibility, CNBC reported, and said they targeted the Bahrain facility for Amazon’s support of the U.S. military.

On March 3, AWS was recommending that customers “launch replacement resources” in an unaffected zone or another region. In April a second Bahrain zone was disrupted and the region went dark. On April 30 AWS wrote that the Bahrain region “has suffered damage due to the conflict in the Middle East and is currently unavailable,” told customers to “recover their resources in other Regions from remote backups,” and said restoring normal operations “is expected to take several months.”

Then nothing public until September 15, which CNBC called AWS’s “first public update since April.” AWS says it “began recommending that customers migrate their workloads to other Regions” after the first zone was damaged in March, “and most did so before the Region became unavailable.” One customer, Careem, recovered by moving its work overnight, Ars Technica reported. What is gone is narrower than “all data”: whatever a customer kept only in Bahrain, or only in that one UAE zone, and did not move in time. For that, AWS says it “exhausted every option.”

For Bahrain, AWS “will share a further update in early 2027.” For the UAE zone, AWS says it is “working on replacing the affected infrastructure” and will update “in the coming months.”

The July claim. On July 21, Iran’s Revolutionary Guards claimed their aerospace force had “destroyed” Amazon’s central data infrastructure in Bahrain with cruise missiles, Euronews reported. Amazon had not responded. A week later, Bloomberg reported that lower-resolution images from the European Space Agency’s Sentinel-2 satellites, reviewed by its reporters, “show damage at both facilities,” two Amazon sites at Zallaq and Askar. AWS has not confirmed a July strike in anything we read, and its September 15 text does not mention one. The images show damage; they cannot by themselves date it.

What it cost Amazon. Amazon’s first-quarter filing, made April 30, said other operating expense, which rose from $308 million to $447 million, “was primarily related to charges associated with damaged data centers in the Middle East in Q1 2026, asset impairments, and the amortization of intangible assets.” It gave no separate amount. Its second-quarter filing, made July 31, does not mention the Middle East, Bahrain, the UAE or Iran at all. The most-quoted figure, $150 million, is an outside estimate, reported by Forbes and Ars Technica, of what Amazon gave up by waiving March charges for affected customers; the outlets point to different origins for the number. Ars Technica says that figure does not include the damaged buildings. Against AWS, it is small: on our arithmetic, about 0.4 percent of AWS’s first-quarter sales of $37.6 billion. It compares an outside estimate with a reported total, so read it only as scale. In the second quarter, AWS sales rose 37 percent from a year earlier, to $42.2 billion.

So the damage was permanent for some customers and minor for Amazon. What mattered more is what the rest of the Gulf learned from it.

What you can’t move and can’t insure

A ship can leave a war zone. A data center cannot. It is a building tied to a power grid and a fiber network. That is the first lesson of March.

The second is that the usual insurance does not cover it. “Typically a policy excludes war,” Tom Harper, the data-center leader at the insurance broker Gallagher, told Forbes in April. “So if it’s an active war, it’s not gonna be covered.” As Semafor put it, that sends owners to a separate, specialty war market.

That market shrank fast. In early April, Joe Peiser, chief executive of Risk Capital at the broker Aon, gave Semafor two numbers. A $100 million war-and-terrorism policy that cost $250,000 a year before the fighting cost $5 million by then, 20 times the old price. And the most a data-center developer could buy for a single property fell from up to $3 billion before the war to, in his words, “Today the max we could probably do is $100 million.” Semafor reported that Peiser estimated about $50 billion of such war policies were already active in the Middle East, written at lower premiums than today’s risks would command.

Set that $100 million against what is being built. Reuters puts the first phase of the UAE’s flagship AI campus, a 1-gigawatt cluster called Stargate UAE, at $30 billion. On our arithmetic, $100 million is about one-third of one percent of that. The caveat: Aon’s number is cover for a single property, from one broker, in April, and a $30 billion campus is not one property. The narrower point stands: the largest war policy one big broker could write on one site was tiny next to the campuses going up.

As for the rest, Ars Technica wrote in late April, in its own words rather than an insurer’s: “Data center developers are already eating the costs of uninsurable war damage from the conflict.”

These insurance numbers stop in April. We found no figure for Gulf data-center war cover from May to October from Aon, Gallagher, Lloyd’s, Marsh, WTW or Howden. The only later item we found is qualitative: the trade publication The Insurer reported on September 18 that after Houthi attacks on Saudi Arabia, political violence and terrorism pricing “has risen.” We found no sign that insurers have come back to write large data-center war cover.

That leaves a question we cannot answer. Carnegie’s June model, which we return to below, assumed a war-insurance premium of 0.5 percent of capital spending a year for an Emirati data center in a short war. That assumes someone will sell the cover. We do not know whether it can be bought at that price at campus scale, and nobody we read says.

Spread out and dig in

The Gulf’s answer showed up in September. On September 11, Reuters reported, citing six sources, that the UAE “is quietly revising plans for a 5-gigawatt AI data center project … after the Iran war prompted a rethink of how and where critical infrastructure should be built.” The original plan was one 10-square-mile campus in Abu Dhabi. Four sources told Reuters it will now likely be “a network of data centers spread across the UAE.” The measures under consideration: air defenses, underground construction, mountains for sensitive data, blast-resistant concrete, backup power and cooling, drone and missile interceptors, and jamming.

There was a reason to think about mountains. In April, Iran’s armed forces released a video naming Stargate UAE as a potential target, with the caption “Nothing stays hidden from our sight.” Two people confirmed to Reuters that the site shown was near Al Dhafra Air Base.

The first phase goes on. Reuters’ sources said it was “expected to continue as planned, although with some modifications.” G42, the UAE firm that leads the project, said work was progressing as planned, and added: “The project’s specifics are subject to continuous review in line with the security, resilience and operational standards expected of critical infrastructure at this scale.” OpenAI said it was making “good progress.”

One way to read the move: slack versus efficiency. Resilience is bought with what a consultant would call waste.

Think of a bank that keeps all its cash in one big vault. One set of walls, one set of guards, one alarm: efficient. Then the vault gets hit. The bank does not close. It opens several smaller vaults in different places, hires more guards and buys armored trucks to move money between them. It is safer. It is also slower and more expensive, and it is still a bank.

That is the UAE’s redesign as Reuters’ sources describe it: one efficient 10-square-mile campus likely becomes a network spread across the country. Backup power and cooling, interceptors and buried halls do nothing on a quiet day. They are slack, and slack shows up as cost. An S&P Global Ratings report, covered by AGBI on October 13, said physical hardening “could raise costs by about 5 to 7 percent.” A security consultant, John Bekisz of Guidepost Solutions, told Forbes in April that more advanced security costs more, “as much as five percent of construction costs.”

A second vault never shows up as a cancelled project. It shows up as the same project, built differently, at a higher price.

Other builders are making the same trade. Microsoft announced in September that it plans “to invest more than $10 billion across the United Arab Emirates, Saudi Arabia, Qatar and Kuwait between now and 2030,” plus more than $400 million in subsea and land connections. Reuters reported that Microsoft is also helping Gulf countries with readiness and critical data protection as part of what it called a “digital resilience initiative.” A smaller developer shows both moods at once. On April 27, Pure Data Centre Group announced it “recommitted its focus on the Middle East” after a UAE utility approved an expansion at its Abu Dhabi site, which shrapnel had hit. In late April, Ars Technica reported that the company was pausing new investment decisions in the region. Two days after the recommitment, its chief executive, Gary Wojtaszek, told CNBC: “No one’s going to put in new additional capital at scale to do anything until everything settles down.”

The new target is the money

Here is Ghalibaf’s post in full. It went up on X at 11:55 a.m. Central time on October 18, in English:

“The Persian Gulf Data Authority is coming. To governments, funds, and firms in the region: you are kindly advised to give no resources to any AI or data company aiding invasions or killing children. No finance, equity, land and energy.” A separate line said: “Assist them and face our enforcement.”

Finance, equity, land, energy. Not servers. The post is aimed at the people who pay for data centers and the governments that give them sites and power.

One Revolutionary Guard-affiliated news agency has said why that channel matters. In an article titled “Why Is Artificial Intelligence on the Target List?”, Tasnim argued that attacks on AI centers could “undermine US technological competition with China, deter investment and put pressure on US stock markets,” according to Iran International. Tasnim was writing about attacks, not about Ghalibaf’s finance cutoff, but it names deterring investment as one effect it expects.

The threat behind it came from Rezaei, around October 10 or 11, in an interview with Iran’s state broadcaster Press TV. The AP, citing Iran’s state news agency, reported that he threatened “cables, data centers, AI facilities and other sites in the region” if intense fighting breaks out again. Iran International reported that he “claimed those assets and the region’s digital infrastructure were worth more than $2 trillion,” and a Press TV writer gave the same figure. The $2 trillion is Rezaei’s claim. The AP’s text of his remarks does not include it, we found no transcript, and nobody has shown how the number was reached. In a written interview Drop Site News published on October 21, he repeated the threat: “In the event of war, cables, data centers and artificial intelligence facilities could also come within range.”

What is the “Authority”? So far, a sentence. Ghalibaf “did not explain how the proposed authority would operate, what powers it would have or how Iran could enforce restrictions on companies operating elsewhere in the region,” Iran International reported. We found no bill, decree or agency by that name.

So the only enforcement Iran has shown is the kinetic kind. By March 11, Tasnim had published a list of offices and infrastructure of U.S. companies, among them Google, Microsoft, Palantir, IBM, Nvidia and Oracle, in Israeli cities and some Gulf countries, calling them “Iran’s new targets,” Al Jazeera reported. At the end of March a Guard-affiliated Telegram channel named a list of 18 tech companies as “legitimate targets,” per CNBC, including the UAE’s G42, with the line: “From now on, for every assassination, an American company will be destroyed.” The lists came after the strikes on Amazon, on March 1 and 2, and widened the threat. That history gives Ghalibaf’s post its weight. Without it, the post is a slogan.

As of October 23, we found no public response to Ghalibaf’s post or Rezaei’s remarks from any of the big cloud companies or any Gulf government. Five days on, that silence still proves little.

The case against our reading

The strongest argument against us: the threat is not working, and the money proves it. Gulf governments and Microsoft are paying to harden and spread out rather than leave, and the strikes were a one-time event whose repair bill fell mostly on Amazon, which can afford it.

Microsoft’s Brad Smith said on September 23, Reuters reported: “We’re sustaining all the investments we planned to make before this conflict started, and we’re in fact adding to them … It’s an aggressive spending schedule.” AWS announced a partnership worth more than $5 billion with Saudi Arabia’s Humain in May 2025, before the war, and AGBI listed it on October 13 among Saudi projects. Microsoft’s Saudi cloud region is due to go live in November, AGBI reported.

Carnegie’s June model found that if the war is short (a six-month delay, a 10 percent rise in non-IT construction costs and a war-insurance premium of 0.5 percent of capital spending a year), an Emirati data center’s life-cycle return would be about 1.7 percent below an American one, against 3.5 percent above in the baseline. If the war is prolonged (a one-year delay, costs up 20 percent, a 1 percent premium), the gap widens to about 7.8 percent. Carnegie says delay is the biggest driver of lost returns. The Middle East Institute’s Mohammed Soliman, summarizing the model in September, wrote that demand and pricing power matter more than the cost shocks.

That argument is right on volume: we found no cancelled project, and Microsoft says it is adding. But most of the deals we found were struck before the war, so they show money staying, not new money arriving. Nor does it answer the other half. The UAE is redesigning its flagship campus, hardening adds an estimated 5 to 7 percent, and by Ars Technica’s account developers are absorbing war damage they cannot insure. None of that is a cancelled deal. All of it changes how the region builds and who holds the risk. And Ghalibaf’s post is aimed at the one link in the chain that has not yet moved: the funds, landlords and utilities. The next test is whether any of them blinks.

What to watch

October 29. Amazon reports third-quarter results. The filing that follows is the first since AWS said it cannot restore the Bahrain data.

November 3. The U.S. midterm elections. Iran International reported that President Trump said the U.S. would not attack before then, though on October 1 he said “maybe before the election.” On October 23 it reported that U.S. officials said no decision had been made on resuming strikes after November 3. USNI News reported on October 22 that there had been 27 attacks on commercial ships so far in October, according to the International Maritime Organization, the most of any month since the war began. After the vote, the conditional in Rezaei’s threat could come back into play.

December 31. The end of the year Reuters said Stargate UAE’s first 200 megawatts were “due to come online.” That is our call below.

Any day. Houthi strikes on Saudi Arabia are the nearest live threat to Gulf compute. Houthi forces in Yemen have struck Saudi targets, including Riyadh’s airport, AGBI reported, and CNBC reported on October 18 that Saudi Arabia’s energy ministry said militants hit an Aramco administrative building in Dhahran. No Houthi strike has been confirmed on a data center, AGBI reported, but Hannah Porter of Ark Group said “the Houthis likely have the capabilities to target data centres if they chose to.”

Our call

We put it at 60 percent that Stargate UAE’s first 200 megawatts will not be announced as operational by December 31, 2026.

The 60 is our judgment. We found no usable base rate for a giant AI cluster being redesigned for war while it is built, and we will not invent one. What pushes the number up: Reuters’ sources said the first phase continues “with some modifications,” and a redesign for war predicts delay. That is our inference; Reuters’ sources did not say the modifications would slow the first phase. What holds it down: G42 says the work is progressing as planned, OpenAI says “good progress,” and about ten weeks remain.

The call is wrong if, by December 31, 2026, a named Stargate UAE partner or the UAE federal or Abu Dhabi government says on the record that the first 200 megawatts are operational. The call box below sets out the full rules. We found no such statement as of October 23. The call tests whether it is announced, not whether it is built, so a quiet start would count as a win for us even if it undercut the delay theory. We score it by January 5, 2027, in public, either way. An on-time launch would tell us the strikes changed less than this story argues.

The bottom line

In March the Gulf learned that its data centers can be hit, cannot be moved and cannot be fully insured. It did not stop building. It started building like a bank that lost a vault: more sites, thicker walls, more guards, higher costs. Ghalibaf now wants the people who pay for the vaults to stop paying. As of October 23, we found no sign that any had.

On AWS’s status feed, as mirrored on October 23, the newest entry for Bahrain is still the one from September 15. The next is promised for early 2027.

---

Sources

• AWS Health Dashboard, Bahrain (me-south-1) posts of Mar 3, Apr 30 and Sep 15 2026, via the awsdown.com mirror: awsdown.com. Caveat: the primary dashboard (health.aws.amazon.com) loads by JavaScript and was not opened directly; the Sep 15 sentences match Reuters, CNBC and Help Net Security. The mirrors, fetched Oct 23, list Sep 15 as the newest Bahrain and UAE entries; an indexed dashboard copy dated Oct 22 opens its UAE and Bahrain sections with the Sep 15 posts.
• Reuters via Khaleej Times, Sep 16 2026 (AWS “unable to restore”; “exhausted every option”; next updates): khaleejtimes.com
• CNBC, Sep 15 2026 (“first public update since April”; IRGC claimed responsibility): cnbc.com
• Help Net Security, Sep 17 2026 (UAE zone mec1-az2 text): helpnetsecurity.com. The UAE post text is also confirmed by the awsdown UAE mirror: awsdown.com
• Reuters, Mar 2 2026 (AWS description of the strikes; “first time a major U.S. tech company’s data center has been disrupted by military action”): reuters.com
• Euronews, Jul 21 2026 (IRGC claim of a cruise-missile strike in Bahrain): euronews.com. Caveat: a claim; Amazon had not responded.
• Bloomberg, Jul 28 2026 (Sentinel-2 imagery shows damage at Zallaq and Askar): bloomberg.com. Caveat: paywalled; read from the free teaser only.
• Ars Technica, Apr 29 and May 1 2026 ($150m excludes the damaged buildings; “eating the costs”; Pure DC; Careem): arstechnica.com, arstechnica.com
• Forbes, Phoebe Liu, Apr 21 2026 ($150m estimate; Gallagher’s Tom Harper; Guidepost’s John Bekisz; JLL capacity figures): forbes.com. Caveat: partial paywall; $150m is an outside estimate, not an Amazon figure, and Forbes and Ars point to different origins for it.
• CNBC, Apr 29 2026 (Pure DC pausing investment decisions; Gary Wojtaszek): cnbc.com
• Amazon 10-Q, Q1 2026, filed Apr 30 2026: sec.gov; Amazon 10-Q, Q2 2026, filed Jul 31 2026: sec.gov. Caveat: the 0.4 percent figure is our arithmetic, comparing an outside estimate with reported sales.
• Amazon IR, Oct 15 2026 (Q3 call on Oct 29): ir.aboutamazon.com
• Semafor, Liz Hoffman, Apr 2 2026 (Aon’s Joe Peiser: $250,000 to $5 million; $3 billion to $100 million; $50 billion of policies): semafor.com. Caveat: April figures from one broker; not re-checked since. The $100m against $30bn comparison is ours.
• The Insurer, Sep 18 2026 (political violence and terrorism pricing “has risen”): theinsurer.com. Caveat: paywalled teaser; no numbers.
• AGBI, Oct 13 2026 (S&P Global Ratings 5 to 7 percent; Sofia Bensaid; AWS-Humain; Saudi capacity per SPA; Microsoft Saudi region in November; Hannah Porter): agbi.com
• Reuters, Sep 11 2026 (UAE redesign; Stargate UAE $30bn, 200 MW “due to come online this year”; April video; G42 and OpenAI statements): reuters.com. Caveat: rests on anonymous sources apart from the company statements.
• Reuters, Sep 23 2026 (Microsoft plan; Brad Smith; “digital resilience”): reuters.com. Caveat: read as a page excerpt.
• Carnegie Endowment, Phillips-Robins, Tawil and Winter-Levy, “The Compute Coalition,” Jun 8 2026 (short-war and prolonged-war cases; delay as the main driver of lost returns): carnegieendowment.org. Caveat: the page text was read; the PDF was not opened.
• Middle East Institute, Mohammed Soliman, Sep 30 2026 (summary of the Carnegie model; demand and pricing power): mei.edu
• Ghalibaf on X, Oct 18 2026: x.com
• Iran International, Oct 12 2026 (Rezaei’s $2 trillion claim; Tasnim’s “target list” article; Trump on the midterms): iranintl.com; Oct 18 2026 (no explanation of the authority): iranintl.com; Oct 4 2026 (Hormuz bill): iranintl.com; Oct 4 2026 (Trump’s Oct 1 “maybe before the election”): iranintl.com
• Press TV, Ivan Kesic, Oct 14 2026 (Rezaei interview, $2 trillion): presstv.co.uk. Caveat: Iranian state media; no transcript.
• Drop Site News, Jeremy Scahill, Oct 21 2026 (Rezaei written interview: cables, data centers and AI facilities “could also come within range”): dropsitenews.com. Caveat: a written interview in translation; Iran’s Borna news agency published a differently worded translation on Oct 22.
• Iran International, Oct 23 2026 (U.S. officials: no decision on resuming strikes after Nov 3): iranintl.com
• USNI News, Heather Mongilio, Oct 22 2026 (27 attacks on commercial ships in October per the IMO, most of the war): news.usni.org
• AP via Fortune, Oct 11 2026 (Rezaei’s threat, no dollar figure): fortune.com
• Al Jazeera, Mar 11 2026 (Tasnim’s list): aljazeera.com
• CNBC, Apr 1 2026 (18 companies, per the Guard-affiliated channel): cnbc.com. Caveat: CNBC says 18 but prints 17 names; the Telegram original was not opened.
• CNBC, Oct 18 2026 (Saudi energy ministry: militants hit an Aramco building in Dhahran): cnbc.com
• Congressional Research Service, IN11173, Oct 1 2019 (Abqaiq-Khurais): everycrsreport.com; EIA Today in Energy, Sep 23 2019 (Aramco restoration): eia.gov. Caveat: the 16-day and 236-day counts are ours; the 2019 dates are Aramco’s statements.
• The Understated, “The War Both Sides Need to End,” Jul 7 2026: understated.news