Iran's Islamic Revolutionary Guard Corps (IRGC) claimed a new strike on Tuesday, asserting it targeted an AWS datacenter located in Bahrain. The IRGC announced in a statement that the action was a retaliation against the "child-killing US Army," specifically stating it had struck back at the "child-killing US Army" by attacking Amazon infrastructure in Bahrain. According to the Iranian military branch, the attack specifically struck Amazon infrastructure within Bahrain. This alleged operation marks a reported escalation of cyber activities attributed to the IRGC against targets in the Middle East, signaling a continued pattern of targeting international technology infrastructure.
IRGC Details Retaliatory Strike
The Islamic Revolutionary Guard Corps (IRGC) stated the strike was executed as retaliation for a US attack on Iran's under-construction Darkhovin nuclear facility. This claim shows a direct link between the alleged cyberattack and prior military actions, framing the cyber operation as a tit-for-tat response. The IRGC further claimed that Amazon Web Services' "central data infrastructure" was "destroyed" in the operation. According to the Iranian military branch, this infrastructure was hit by "several cruise missiles," a detail that, if true, would suggest a significant physical or highly disruptive cyber assault rather than a mere denial-of-service attack. The IRGC's statement, delivered on Tuesday, provided these details as part of its official communication regarding the alleged strike.
AWS Service Status and History
AWS's me-south-1 region in Bahrain is reportedly “currently unavailable.” This status update aligns with claims of a successful strike. Further compounding the reported issues, every single AWS service in Bahrain has been offline for months, indicating a prolonged and severe disruption to Amazon's cloud computing capabilities in the region. The last update regarding the state of AWS services in both Bahrain and the UAE within the open issues area of the dashboard was recorded on April 30, suggesting a lack of recent public information from AWS regarding these persistent outages. This prolonged unavailability raises questions about the scope and nature of the disruptions, whether they are direct consequences of alleged attacks or other operational challenges.
Broader Iranian Targeting Strategy
Iranian state-affiliated media had previously claimed that strikes targeting AWS infrastructure in both Bahrain and the UAE were deliberate actions. These alleged strikes reportedly followed US and Israeli attacks on Iran in late February, providing a historical context for the current claims of retaliation. These prior claims also pointed to a consistent strategy of targeting Western technology infrastructure in response to perceived aggressions. Iran has also designated a broader range of technology companies as legitimate targets for potential retaliatory strikes. According to reports, facilities associated with Google, IBM, Microsoft, Nvidia, Oracle, and Palantir have been included in this expanded targeting strategy. This full list of targets indicates a widening scope of potential cyber or physical actions against international tech infrastructure perceived to be linked to adversaries, reflecting a strategic decision to include major global technology players in its retaliatory considerations. The inclusion of such prominent companies suggests a deliberate effort to disrupt critical digital services and infrastructure that support various sectors globally.
Customer Impact and Response
Beyond Bahrain, AWS’ me-central-1 region in the UAE is also described as “unable to reliably support customer applications.” This parallel disruption in a neighboring region suggests either a coordinated attack or widespread systemic issues affecting AWS operations across parts of the Middle East. Following the attacks on its infrastructure, Amazon Web Services (AWS) took the unusual step of waiving all usage-related charges for March 2026 in its me-central-1 region in the UAE, an action that shows the severity of the service interruptions and the company's efforts to mitigate customer impact. After facilities were damaged, AWS-hosted providers, including Snowflake and Red Hat, urged affected customers to fail over or move workloads to other regions. This advice notes the significant operational challenges faced by businesses relying on AWS services in these affected regions and the necessity for strong disaster recovery plans. The persistent issues and the advice for customers to relocate their workloads point to a sustained period of instability for AWS services in these parts of the Middle East.
