The cloud is supposed to be everywhere and nowhere. It is supposed to be invisible, resilient, and immune to the physical world. On Sunday morning, Iranian drones taught the world that the cloud is actually a building — and buildings burn.

Amazon Web Services confirmed that drone strikes directly hit two of its data center facilities in the United Arab Emirates and damaged a third facility in Bahrain. The attacks caused structural damage, disrupted power delivery, triggered fire suppression systems that caused additional water damage, and knocked dozens of core cloud services offline across the Middle East.

This is the first time in history that a major technology company’s cloud infrastructure has been destroyed by military action. The implications extend far beyond the immediate outage.

AWS initially described the incident in carefully neutral language, reporting that “objects” had struck a data center, creating “sparks and fire.” Fire departments shut off power to the facility and generators while they extinguished the blaze. It took a full day before Amazon acknowledged the truth: these were drone strikes, connected to the broader military conflict engulfing the region.

The damage was extensive. In the UAE, two of three availability zones in AWS’s ME-CENTRAL-1 region were significantly impaired. In Bahrain, a facility in the ME-SOUTH-1 region was taken offline by a nearby drone strike. Twenty-five AWS services were completely disrupted. Another thirty-four were impaired. The company’s popular EC2 server service, S3 storage, and DynamoDB database were all experiencing elevated error rates.

The knock-on effects rippled across the regional economy. Abu Dhabi Commercial Bank reported that its platforms and mobile app were unavailable. Snowflake, a major data management firm, attributed its own service disruptions to the AWS outage. Businesses across the Gulf that relied on AWS for everything from e-commerce to financial transactions found themselves suddenly offline.

AWS advised customers to “enact their disaster recovery plans and recover from remote backups into alternate AWS regions, ideally in Europe.” The recommendation to migrate workloads to European servers is itself remarkable — an acknowledgment that the Middle East region may remain unsafe for cloud computing for the foreseeable future.

The vulnerability exposed by these strikes is not unique to Amazon. Google, Microsoft, and Oracle all operate data center facilities in Gulf nations that are currently under bombardment by Iranian forces. Microsoft had announced a $15 billion investment to expand its UAE operations by 2029. Google operates a cloud region in Doha, Qatar. The Center for Strategic and International Studies had warned just last week that adversaries could “target data centers, energy infrastructure supporting compute, and fiber chokepoints” — a prediction that proved accurate within days.

The strategic implications are profound. Data centers have become as strategically important as oil refineries — perhaps more so. They house the financial records, communications systems, government databases, and commercial platforms that modern economies depend on. If data centers can be targeted and destroyed in wartime, the entire model of cloud computing in geopolitically volatile regions comes into question.

For individual users and businesses, the Amazon data center strikes raise uncomfortable questions. Where is your data physically stored? What happens to your files, your photos, your financial records if the building housing them is destroyed? Most consumers never think about the physical reality of cloud computing. Iranian drones have forced them to.

The fires at Amazon’s data centers were extinguished. The water damage to server racks is being assessed. But the illusion that the cloud exists somewhere safe, somewhere untouchable, somewhere beyond the reach of war — that illusion has been permanently destroyed.

The cloud, it turns out, is just somebody else’s computer. And somebody else’s computer just got hit by a drone.