Cloud Under Fire: Why the AWS Incident Should Change How We Think About Cloud in Saudi Arabia and the GCC
The recent disruption involving AWS facilities in the UAE and Bahrain should be a wake-up call for every executive, regulator, and technology leader in the Gulf. Reuters reported on March 2 that AWS said some of its data centers in the UAE and Bahrain were damaged during regional drone strikes, causing power and connectivity issues. Reuters also reported on March 22 that Iran threatened U.S. energy and IT infrastructure in the Gulf as the conflict escalated. Whether this proves to be an isolated wartime event or the beginning of a more dangerous pattern, the message is the same: cloud in our region can no longer be viewed only as an IT decision. It is now part of the broader critical-infrastructure and geopolitical risk equation. (Reuters)
For years, most cloud conversations in Saudi Arabia and the GCC were centered on cost, scalability, security, compliance, latency, and vendor lock-in. Those issues still matter, but they are no longer enough. The real lesson from this incident is that cloud resilience and cloud availability are not the same thing. AWS’s Bahrain and UAE regions each have three availability zones, and Microsoft has said its Saudi Arabia East region, planned for Q4 2026, will also include three availability zones with independent power, cooling, and networking. That is excellent for technical redundancy, but geopolitical resilience requires more than architecture inside a single region or even a single country. (AWS Documentation)
This is why I believe the next phase of cloud strategy in the GCC will be shaped by one idea above all others: resilience by design. Not just cyber resilience. Not just disaster recovery on paper. Real operational resilience that assumes physical disruption, energy instability, telecom dependency, and regional escalation are all possible. The cloud sector has always depended on physical infrastructure, but the AWS incident made that dependence impossible to ignore. Data centers are not abstract software. They are buildings, energy systems, cooling systems, network routes, supply chains, and people. When the region becomes unstable, cloud becomes exposed in very tangible ways. (Reuters)
That said, I do not think the conclusion should be that Saudi Arabia or the GCC should slow down cloud adoption. My view is the opposite. The right conclusion is that the region must move from cloud enthusiasm to cloud maturity. Saudi Arabia already has the policy direction for that. The Kingdom’s Cloud First Policy requires government entities to prioritize cloud options in new IT investment decisions, while also linking adoption to cybersecurity, technical viability, cost efficiency, and data-classification requirements. The policy also states that government cloud and commercial governmental cloud data should be hosted inside the Kingdom when those models are used. On top of that, the National Cybersecurity Authority’s Cloud Cybersecurity Controls were updated in 2025 to reflect data-localization requirements, and the personal-data-transfer regulation requires safeguards and risk assessment for transfers outside the Kingdom.
This is exactly why I remain optimistic about Saudi Arabia’s cloud outlook. The Kingdom is not moving away from cloud. It is building toward a more sovereign, more regulated, and more resilient cloud model. Google Cloud opened its Dammam region in November 2023. Oracle now has two Saudi regions, with Riyadh following Jeddah, and Oracle describes this as making it the first hyperscaler with two cloud regions in the country. Microsoft confirmed in February 2026 that its Saudi Arabia East region will become available in Q4 2026, and AWS says it is building a Saudi region for 2026 with a $5.3 billion investment. That matters because local and multi-region presence inside the Kingdom improves not only compliance and latency, but also options for segmentation, failover, and disaster recovery.
The wider GCC story is similar. The UAE’s National Cloud Security Policy, issued in 2023, explicitly frames cloud security as a national priority and emphasizes a risk-based approach, data sensitivity, transparency, and continuous improvement. That tells us something important: the region is not stepping back from cloud. It is recognizing that cloud must now be treated as strategic infrastructure, just like energy, ports, water, and telecom. In other words, the question is no longer whether cloud is essential. The question is whether our cloud strategies are realistic enough for the world we now live in. (UAE Legislation)
In my view, organizations in Saudi Arabia and the GCC now need to ask harder questions before they sign the next cloud contract. Where is production hosted? Where is recovery hosted? What happens if a single country becomes temporarily inaccessible? What happens if cross-border transfer restrictions collide with a disaster-recovery plan? What is the dependency map for power, fiber, peering, and sovereign controls? And perhaps most importantly: does the architecture assume normal times, or does it assume stress? Those are no longer technical questions only. They are board-level questions. The regulatory environment in Saudi Arabia and the UAE is already moving in that direction, and the market will follow.
The cloud market in Saudi Arabia and the GCC is not becoming less relevant because of this incident. It is becoming more serious. More strategic. More regulated. More political. And ultimately, more important. The winners in the coming years will not just be the providers with the biggest brands or the broadest service catalogs. They will be the providers, and the customers, who understand that in this region resilience is no longer a feature. It is the product.
Originally published in the VerbionPulse newsletter on LinkedIn: Cloud Under Fire: Why the AWS Incident Should Change How We Think About Cloud in Saudi Arabia and the GCC.
Comments