The cloud is a building, and it's vulnerable

The cloud is a building. It has a street address and a power bill. And on March 1st, it got hit by a drone.

Iranian Shahed-136 drones struck two Amazon Web Services data centres in the UAE and a third in Bahrain. Two of three availability zones in the UAE region went offline. Structural damage, fires, water damage from the suppression systems. Banking apps across the Gulf stopped working. Payments platforms went down. Careem, the region's biggest ride-hailing app, couldn't process rides. Emirates NBD and First Abu Dhabi Bank customers couldn't access their accounts.

Three weeks later, Bahrain was hit again.

The tech industry chose the word "cloud" for a reason. It makes infrastructure feel weightless. Everywhere at once. Invulnerable. Your data isn't sitting in a warehouse with diesel generators and water cooling systems in a country with its own politics and geography. It's in the cloud. Floating safely above all of that.

This is the most successful piece of marketing language in the history of technology. And it's a pattern.

"Serverless" computing still runs on servers. Someone else's servers, which you don't manage but absolutely depend on. "The edge" sounds like proximity, closeness, speed. It's still a building. A smaller building, closer to you, but a building with power and plumbing and a government that controls the land beneath it. And "AI" implies intelligence floating in the ether. The reality is data centres consuming as much water as small cities, powered by energy grids that are already under strain, dependent on chip supply chains that run through Taiwan.

Every one of these terms was deliberately chosen to make something physical feel immaterial. 

And it works brilliantly, right up until something physical happens.

What changed on March 1st

Previous disruptions to cloud infrastructure were weather events, power failures, human error. Operational risks. Annoying, but containable within the usual frameworks.

A drone strike is different. Iran's Revolutionary Guard explicitly claimed the attacks, citing the data centres' role in supporting US military and intelligence operations. This wasn't a storm that happened to hit a server farm. It was a deliberate military decision to target commercial cloud infrastructure.

That's a new category of risk. And it's one that the word "cloud" makes it very easy to forget about.

The boundary between commercial cloud computing and military operations has largely vanished. The same infrastructure that processes your bank transfers also runs Pentagon workloads. When everything shares the same pipes, an attack on one is an attack on all.

Two weeks after the strikes, Rachel Reeves announced a £2.5 billion investment in AI and quantum, including a £500 million Sovereign AI Fund. The language was all about "sovereign capability" and "reducing reliance on overseas infrastructure."

It's not hard to connect the dots. If your AI systems depend on data centres in another country, you're dependent on that country's stability. March 1st made that dependency visible in a way that PowerPoint decks about geopolitical risk never could.

What this actually means

Nobody is going to stop using the cloud. The abstraction is genuinely useful. You don't need to think about where every server is to send an email.

But abstraction layers are also what make you vulnerable to surprises. The drone strikes in Bahrain weren't surprising to anyone who'd thought about where the building was. They were only surprising to people who'd internalised the metaphor.

If you're a business running on cloud infrastructure, do you know which region your data is in? Do you know what happens if that region goes offline for 48 hours? Have you ever asked your cloud provider where the building actually is?

Most people haven't. That's the point.

The word "cloud" is a masterpiece of marketing. It's so good that even the people running their businesses on it forget they're renting