Data centers | Resilience
Data centers are targets in both wars. Know where your mission data lives, and where its copy lives.
On March 1, 2026, Iranian drones hit 2 AWS data centers in the UAE, and a data center in Bahrain was also hit. In September, AWS said some of the data hosted there cannot be restored. On October 18, a Russian internet company said drones attacked its data center near St. Petersburg. Here are the questions every program should be able to answer about data center resilience.
01 | The strikes
What happened to data centers in 2026
Before dawn on March 1, 2026, Iranian Shahed drones hit 2 AWS data centers in the United Arab Emirates. A commercial data center in Bahrain was also hit. Iran's Revolutionary Guard said the strikes targeted data centers supporting "the enemy's" military and intelligence activities.
March 1, 2026
Drones hit 2 AWS data centers in the UAE, and a data center in Bahrain is also hit.
March 11, 2026
A Bank Sepah data center in Tehran is reportedly struck by a missile, apparently fired by U.S. or Israeli forces.
Early April 2026
An internal AWS memo, as reported by Big Technology, says "We do not have a timeline for when DXB and BAH will return to normal operations," and AWS works to move affected customers to other regions. The Financial Times reports another drone strike on an Amazon data center in Bahrain on April 1.
July 2026
The Revolutionary Guard claims another attack on the AWS Bahrain region.
September 2026
AWS says it cannot restore access to resources hosted only in its Bahrain region or only in 1 UAE availability zone. It plans a Bahrain update in early 2027. Amazon disputed reporting that it would not reopen the facilities.
October 18, 2026
Russian internet company VK says drones attacked its data center in the Leningrad region and that services stayed available. A Ukrainian drone maker says the Ukrainian military struck it.
October 20, 2026
A senior Iranian official, Mohsen Rezaei, says Tehran could target undersea cables, data centers, and AI facilities linked to the United States if another war broke out.
It is not clear that U.S. military data was in the Gulf facilities, and a Georgia Tech analysis notes that U.S. rules generally require government data to be stored in the United States or on military bases. The same analysis made the broader point: the strikes "are forcing nations to recognize that data centers are targets of war." This article takes no position on the war. It covers what a program can control: where its data sits and where the copy sits.
The question for your program
If the facility holding your mission data were hit tonight, where would you restore from?
If the answer is a second facility in the same region, check how far apart they are.
02 | The geography
A region is close enough to be hit together.
AWS describes the Availability Zones in a region as "meaningfully distant from each other, up to 60 miles (~100 km) to prevent correlated failures," while staying close enough for synchronous replication. That spacing protects against the loss of 1 facility to a fire, a flood, or a power failure. A strike campaign across a region can reach several facilities in it.
The UAE results show the difference. Resources spread across zones had a path back: AWS was still recovering regional resources and resources in the 2 other UAE zones. Resources that lived only in the damaged zone could not be restored. In Bahrain, the damage spanned multiple zones, and resources that lived only in that region could not be restored.
Our rule of thumb
Copies in separate buildings protect against a fire. Copies outside the threat range protect against a strike campaign.
03 | The control
Federal controls already ask for distance.
NIST SP 800-53, the federal catalog of security controls, includes 2 controls written for this case.
CP-6(1)
Alternate storage site
"Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats."
CP-7(1)
Alternate processing site
The same separation applies to the site where systems would run after a loss: far enough from the primary to reduce susceptibility to the same threats.
For a site in a war zone, "the same threats" includes drones and missiles. The copy that satisfies these controls has to sit outside their reach.
Ukraine moved first
In February 2022, Ukraine's parliament passed a law allowing government and private sector data to move to the cloud. AWS flew 3 Snowball devices, built for offline transfer of large amounts of data, into Ukraine through Poland to back up state registers such as population, property, and tax records. Ukraine's digital transformation minister, Mykhailo Fedorov, later said, "Russian missiles can't destroy the cloud."
The 2026 Gulf strikes add the other half of that lesson. A cloud region is still a set of buildings, and a region inside the threat range shares the threat.
04 | The 4 questions
What every program should be able to answer about data center resilience
| Question | What to find out | What good looks like |
|---|---|---|
| 1. Where does mission data live? | Every system that holds mission data, the site, region, or zone it sits in, and every copy | A written inventory, current within the last quarter, owned by a named person |
| 2. Is a copy outside the threat range? | Where the backup or replica sits, and whether the threats to the primary can reach it | A copy in a separate region or site beyond the reach of the threats to the primary, with its own credentials |
| 3. How long can the base run locally? | Which services and data the base needs if reachback to that copy fails | Local services and storage sized for the longest period the base plans to operate on its own |
| 4. Has the restore been tested? | How long a full restore from the distant copy takes, and who does it | A timed restore on a schedule, with results written up and the gaps fixed |
Most programs can answer question 1 for their own systems. The harder part is data held by contractors, coalition partners, and software services that run in a provider's region the program never chose. Ask each of them the same 4 questions.
05 | The local copy
A distant copy keeps the data. A local copy keeps the base running.
The copy outside the threat range protects the data from loss. If the base also loses its link to that copy, it needs enough on site to keep working: the applications it runs every day, the data they need, and a recovery copy an attacker cannot reach.
Chapter 10 of our Dell Federal guide covers both halves. Dell's edge operations software deploys and manages applications on nodes at remote sites, and Dell's cyber recovery design keeps a copy in an isolated vault with its own credentials and management plane, so a restore stays trusted when production or backup systems are in doubt.
06 | How we help
Where Dell Federal and Paragon Micro fit
As a Dell Technologies Federal Platinum Partner and multi-vendor technology provider, we build the data center and recovery systems that keep a program's data in more than 1 place, and we document where each copy lives.
2 sites, 1 system
Tinker Air Force Base
For the Air Force's 76th Software Engineering Group, we delivered a 1,600 user virtual desktop system across 2 operational sites, with active active management clusters and 800 users per site.
2 facilities, no downtime
NIH NIAID
For NIAID, we delivered replacement high performance computing storage to 2 facilities ahead of a September 29, 2023 deadline while 24 x 7 operations continued for more than 200 researchers, with as built documentation of every configuration.
Recovery planning
Continued operations
Our Dell Federal work on recovery includes zero trust design, authority to operate documentation and control mapping, and planning for continued operations during an incident.
Built before it ships
The System Readiness Center
In our 55,000 plus square foot secure facility, we validate configurations and stage and test systems, so a recovery site can be proven before it goes live.
From order to support
If your team doesn't have the people to install the copy outside the threat range and run the restore test, we can do that work with you.
- 01
We sell it
Servers and storage for the copy outside the threat range and the local copy on base
- 02
We install and integrate it
Staged in our System Readiness Center, then installed at each site and connected to the systems that hold your mission data
- 03
We train your team
Your staff run a full restore from the distant copy with us, timed and written up, so you know how long it takes and who does it
- 04
We support it after
Lifecycle sustainment, current configuration records, and upgrade planning after delivery
Paragon Micro | Dell Federal
Know where your copy lives before you need it.
Send us the systems that hold your mission data and where each one runs today. We can help build the inventory, design a copy outside the threat range and a local copy for disconnected operations, and stage both before they go live.
Army organizations and other federal agencies can order through ITES-4H. The Missile Defense Agency and other Department of War organizations can order through MDA SHIELD, and federal buyers can also use GSA. The right path depends on scope, eligibility, and ordering rules.
Keep reading
Edge operations and cyber recovery
Chapter 10 of our Dell Federal guide covers edge operations and the isolated recovery vault, and chapter 6 covers the servers behind base data centers.
Answers for program offices
Data center resilience: common questions
What is data center resilience?
It is the ability to keep mission data and the systems that use it available after a data center is damaged or cut off. In practice it means knowing where the data lives, keeping a copy outside the reach of the same threats, running critical services locally, and testing restores on a schedule.
Was U.S. military data affected by the 2026 strikes on AWS data centers in the Gulf?
It is not clear. A Georgia Tech analysis said it was not clear that the U.S. military used those data centers, and noted that U.S. rules generally require government data to be stored in the United States or on military bases.
Do multiple availability zones protect data from a strike?
They protect against the loss of 1 facility. AWS places the zones in a region up to about 100 km apart, so a campaign across a region can reach several of them. In Bahrain, the damage spanned multiple zones, and AWS said resources hosted only in that region could not be restored.
What do federal controls say about backup site distance?
NIST SP 800-53 control CP-6(1) calls for an alternate storage site sufficiently separated from the primary to reduce susceptibility to the same threats, and CP-7(1) applies the same separation to the alternate processing site.
How far away should the copy be?
Far enough that the threats to the primary site cannot reach it. For a site in a war zone, that means outside the range of the drones and missiles that threaten the primary, which usually points to a separate region or a stateside site. The program's threat assessment sets the final answer.
How does Paragon Micro help?
We build data center and recovery systems that keep data in more than 1 place, document where each copy lives, and stage the systems in our System Readiness Center before they go live. For Tinker Air Force Base, we delivered a 1,600 user system across 2 operational sites.
Reference desk
Sources and further reading
Public sources as reviewed October 22, 2026. Reporting on the strikes changes as providers and governments release more detail, so confirm current conditions before you plan around them.
ViewHide 13 sourcesPrimary and supporting references
Amazon Web Services. (n.d.). Availability Zones. AWS Fault Isolation Boundaries. https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/availability-zones.html
Anderson, T. (2022, November 30). 'Russian missiles can't destroy the cloud': Ukraine leader describes emergency migration. The Register. https://www.theregister.com/2022/11/30/ukraine_cloud_migration/
BERNAMA. (2026, October 20). IRGC cites seven internet cables under Strait of Hormuz, warns of 'new targets' [Anadolu report]. https://www.bernama.com/en/world/news.php?id=2622814
Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
Morales, J. (2026, April 4). Iranian missile blitz takes down AWS data centers in Bahrain and Dubai. Tom's Hardware. https://www.tomshardware.com/tech-industry/iranian-missile-blitz-takes-down-aws-data-centers-in-bahrain-and-dubai-amazon-declares-hard-down-status-for-multiple-zones
Murphy, D. (2026, April 1). Why Iran targeted Amazon data centers and what that does, and doesn't, change about warfare. Georgia Tech News. https://www.gatech.edu/news/2026/04/01/why-iran-targeted-amazon-data-centers-and-what-does-and-doesnt-change-about-warfare
Paragon Micro. (n.d.-a). Dell Federal. https://www.paragonmicro.us/partners/dell-federal/
Paragon Micro. (n.d.-b). NIH NIAID high performance computing storage modernization. https://www.paragonmicro.us/past-performance/nih-niaid-high-performance-computing-storage-modernization/
Paragon Micro. (n.d.-c). Secure integration & staging facility. https://www.paragonmicro.us/about-us/facility/
Paragon Micro. (n.d.-d). USAF VDI modernization at Tinker AFB: 1,600 user hyperconverged deployment. https://www.paragonmicro.us/past-performance/usaf-vdi-modernization-at-tinker-afb-1600-user-hyperconverged-deployment/
Paragon Micro. (2026). Dell Federal and Paragon Micro: How the partnership is positioned for FORTRESS America, Project Meridian, and the Autonomous Warfare Command. https://www.paragonmicro.us/dell-federal-paragon-micro-dow-initiatives/
Reuters. (2026, October 18). One killed, 15 injured in Ukrainian drone attack on St Petersburg and Leningrad region. ThePrint. https://theprint.in/world/one-killed-15-injured-in-ukrainian-drone-attack-on-st-petersburg-and-leningrad-region/3075258/
Swinhoe, D. (2026, September 16). AWS "unable to restore access" to data centers hit by Iran strikes. Data Center Dynamics. https://www.datacenterdynamics.com/en/news/aws-unable-to-restore-access-to-data-centers-hit-by-iran-strikes/