AWS’s UAE Region Has Been Running on 2 of 3 Availability Zones for 199 Days — the 5 Questions I Should Have Asked Every Dubai Cloud Hire Before March

I have been screening cloud and platform engineers for Dubai clients since before the UAE region existed, and until this year the question “what happens if your region goes away” was a whiteboard exercise. On 1 March 2026 it stopped being one. Two AWS data centres in the UAE and one in Bahrain were hit by Iranian drones before dawn, two of the three availability zones in ME-CENTRAL-1 went dark, and by the middle of that week Careem, two payment apps, two banks and an investment platform were explaining outages to their customers. I assumed, like most people, that it would be fixed in weeks. On 15 September, 199 days later, the reporting says it is not. This article is about what that has done to how I screen a cloud hire — and the five questions I wish had been at the top of my list before March.

What Happened, in the Words of the People Who Reported It

The strikes were confirmed by Amazon itself on 2 March. CNBC’s headline that morning was “Amazon says drone strikes damaged 3 facilities in UAE and Bahrain”. The Register reported the same day that two of the region’s three availability zones were knocked offline, with outages across EC2, S3, DynamoDB, Lambda and RDS. It was the first time a hyperscale cloud provider had been directly disrupted by military action.

The customer impact was visible within 48 hours. eMarketer’s report of 5 March, “Drone attacks on Middle East AWS facilities disrupt UAE digital services, fintechs”, named Careem, Alaan, Hubpay, Abu Dhabi Commercial Bank, Emirates NBD, Sarwa and Snowflake among the services affected, and noted that AWS was directing customers to shift workloads to US, European or Asia-Pacific regions. The Deloitte analysis quoted in that piece made the point that would define the next six months: business continuity plans rarely account for weeks-long infrastructure outages.

On 7 April, with the Bahrain region in what AWS itself was calling “hard down” status after a second strike on 1 April, AWS CEO Matt Garman told CNBC: “It’s a really difficult situation, and we’re working incredibly hard … we have teams, 24/7, working to make sure that we can keep our infrastructure up for our customers in that region.” Satellite imagery published at the end of July confirmed further strikes on the Bahrain sites in July.

Then, on 15 September, CryptoBriefing published “Amazon Web Services struggles to restore cloud access in Bahrain and UAE after military strikes”: as of mid-September, AWS has been unable to restore full operations at ME-SOUTH-1 or at one of the three availability zones inside ME-CENTRAL-1, the majority of computing services at both damaged facilities remain disrupted, and AWS has suspended billing in the affected regions. Google Cloud and Microsoft Azure, which both operate in the Gulf, have reported no comparable disruption.

Why This Is a Dubai Hiring Story, Not an Amazon Story

The UAE region opened in 2022 precisely so that regulated businesses — banks under Central Bank outsourcing rules, government entities, anyone bound by the UAE’s Personal Data Protection Law — could keep data in the country on a hyperscaler. That is exactly the customer base that could not simply follow AWS’s advice to “shift workloads to US, Europe or Asia-Pacific”. A payment company in DIFC with a data residency undertaking does not have a Frankfurt option at 6 a.m.; it has a set of very specific questions about which of its data can leave, under which contract, and for how long.

Those questions were answered, in March, by whichever engineer happened to be on call. Some of them answered brilliantly: they had a warm standby in another region, region-agnostic Terraform, database replication that had been tested, and a written plan for what to do with the data that could not move. Others discovered that their S3 bucket names were hard-coded, their KMS keys were regional, their payment provider’s webhook allow-list only knew one set of IPs, and their “multi-AZ” RDS instance had both AZs in the two that got hit.

That difference is now the most useful signal I have when screening a cloud, DevOps, SRE or platform engineer for a UAE role. It is more predictive than any certification, because it is the difference between having designed for failure and having survived it. The five questions below are how I surface it in a 45-minute call.

The 5 Questions I Now Ask Every Dubai Cloud Hire

1. “Which region is your failover region, and when did you last fail over to it for real?”

The first half of the question filters for architecture; the second half filters for practice. A strong answer names a region with a defensible latency story for UAE users — Bahrain used to be the obvious pair and is gone, so today that means eu-south-1 in Milan, eu-central-1 in Frankfurt or ap-south-1 in Mumbai, each with roughly 100 to 150 milliseconds of added round-trip — and then describes a drill: a date, a recovery time achieved, and something that broke during the drill. If the candidate has never failed over outside a slide deck, they will say “we have a DR plan” and stop. Ask what the recovery point objective was and whether they hit it.

2. “What in your current stack is pinned to a single region or availability zone?”

This is the question that separates engineers who have done an inventory from engineers who assume. IAM is global, but KMS keys, S3 buckets, EBS volumes, Elastic IPs, RDS snapshots and Lambda functions are regional; Route 53 health checks and DynamoDB global tables exist precisely to bridge that. A good candidate will also mention the boring things that bit teams in March: certificates issued in one region, secrets stored in a regional Secrets Manager, CI runners that could not reach the surviving zones, and the “multi-AZ” setting on a database that only spans two of three zones by default. The best answer I heard this year ended with “and our alerting lived in the same region as the thing it was alerting on”.

3. “How do you handle data residency when the failover target is outside the UAE?”

For a bank, a fintech, a healthcare platform or anyone selling to government, this is the question that decides whether the candidate can be trusted with the architecture at all. The strong answer separates data classes: what can leave the country under the contract and the law, what can leave in encrypted form with keys retained in the UAE, and what cannot leave at all and therefore needs a second in-country provider. That last category is why Azure’s UAE North and UAE Central regions, Oracle’s Abu Dhabi and Dubai regions, and the sovereign cloud offerings from local operators are suddenly in every Dubai architecture conversation. A candidate who says “we would just fail over to Frankfurt” for a CBUAE-regulated workload has not worked in one.

4. “Which of your third-party dependencies live in the region you would lose?”

Snowflake was on the list of affected services in March. So, for many UAE fintechs, were payment gateways, KYC providers, SMS providers and identity platforms that had themselves chosen the UAE region for the same residency reasons. Your own failover is worthless if the service that signs your transactions is in the zone that went dark. I want to hear a candidate describe a dependency map with regions attached, an allow-list that already includes the failover region’s egress addresses, and a conversation they had with a vendor about the vendor’s own DR. Most have never had that conversation. The ones who have are usually the ones who kept a payment flow alive in March.

5. “How do you run a system in a degraded state for six months, not six hours?”

This one did not exist in my list before this year, and it is the one I now weigh most heavily. Running on two of three availability zones for half a year means capacity planning against a zone you cannot use, re-thinking what “multi-AZ” means when only two zones exist, watching for the quiet cost of cross-region traffic, and handling the human side: an on-call rota that is not in permanent incident mode, customer communications that do not read like a status page, and a decision framework for when to migrate permanently versus wait. Candidates who lived it talk about fatigue and prioritisation. Candidates who did not talk about runbooks. Both are useful; only one has done it.

What the Dubai Market Looks Like When You Screen This Way

Since April we have put the five questions to 24 cloud, DevOps, SRE and platform candidates for Dubai and Abu Dhabi roles. The pattern is consistent enough to share. Nearly everyone can answer the first half of question one. Fewer than half can answer the second half with a date. Question two is where the inventory-versus-assumption split shows: about a third had genuinely audited their regional dependencies before March, and most of the rest did it during March. Question three is the hardest: only seven candidates gave an answer that a compliance officer at a bank would accept. And on question five, the candidates who had run a degraded region for months were immediately identifiable, because they were the only ones who talked about cost and people rather than just topology.

Ranges are from our own 2026 placements and offers we have seen candidates decline; they are indicative, not a survey. Our AWS, site reliability and platform engineering benches are where these profiles sit, and the process we use to fill them is the one in our multi-cloud engineer hiring guide.

What to Do This Week If You Run Engineering in the UAE

Three things, in order. First, ask your own team the five questions before you ask a candidate; if your senior engineers cannot answer question two with a written inventory, that is the hire you need, not another feature developer. Second, if you are on the surviving two UAE zones, decide in writing whether you are waiting for the third or migrating — six months of “temporary” is a decision made by default. Third, if you are building anything regulated from scratch, design the residency answer before the region choice: the teams who wrote a fintech platform or a payment gateway in the UAE with data classes defined on day one are the ones who had options in March.

If You Also Run Teams in Singapore

Singapore engineering leaders have been watching the Gulf outage closely, because their own region concentration problem looks similar on paper. Our Singapore colleagues have written up how to build a data centre engineering team in Singapore and what the cloud providers’ availability-zone race means for Singapore cloud hiring; both are useful reading if your platform spans the two hubs, because the residency logic in question three has an exact Singapore equivalent under the PDPA.

FAQ — The AWS Gulf Outage and Dubai Cloud Hiring