The Gulf’s AI Buildout Borrows Ukraine’s Wartime Survival Playbook

Iranian drones knocked three Amazon data centers offline in the United Arab Emirates and Bahrain on March 1, and five months later the Gulf’s trillion-dollar artificial intelligence buildout hasn’t slowed down. It has just gotten more expensive to defend.

The strikes were the first confirmed military attack on hyperscale cloud infrastructure anywhere in the world. What followed wasn’t retreat. It was a scramble to import a survival playbook that another country at war had already spent four years perfecting: Ukraine’s.

Shahed Drones Hit Three Clouds Before Dawn

Before dawn on March 1, Iranian Shahed drones struck two Amazon Web Services (AWS) data centers in the United Arab Emirates, and a third commercial facility in Bahrain was hit the same day. The attacks forced the facilities offline and led to service outages affecting banking, payments, delivery apps and enterprise software across the region.

Iran’s Islamic Revolutionary Guard Corps (IRGC) explicitly claimed responsibility, citing the data centers’ role in supporting American military and intelligence networks. The strikes critically impaired two of three cloud availability zones in the UAE and one in Bahrain, knocking out services for Abu Dhabi Commercial Bank, Emirates NBD, First Abu Dhabi Bank, the payments platforms Hubpay and Alaan, and the ride-hailing app Careem. Amazon’s stock rallied roughly 3% anyway.

The pattern didn’t stop there. On March 31 the IRGC named 18 American companies, including Microsoft, Google, Apple, Meta and Oracle, as legitimate targets. A second Bahrain strike followed on April 1, and Iranian state media claimed a hit on an Oracle facility in Dubai the next day. The target list later grew to cover 29 tech sites region-wide. Iran’s cyber-linked operations widened the pressure too, including a breach that doxed 2,379 Marines stationed across the Gulf, part of a broader campaign against the same U.S. military footprint the data centers quietly support.

Kyiv Already Wrote This Playbook

Washington’s first instinct was to call the Gulf bet a mistake and start pricing an exit. But one country had already run this exact experiment under far heavier fire: Ukraine.

When Russia invaded in February 2022, Ukraine’s government worked with AWS to move critical state data onto cloud servers outside the country within weeks, so that a missile hitting a building in Kyiv could no longer erase the state’s records. It rebuilt its power grid around the assumption of continued attack, pairing solar generation with battery storage rather than relying on centralized plants that make an easy target.

That experience is now on tour. Ukrainian President Volodymyr Zelensky traveled through Saudi Arabia, the UAE and Qatar in late March, with high-level stops in Riyadh, Abu Dhabi and Doha. At least 11 separate requests for drone-defense help came in from governments and private firms across the countries Iran had targeted. By the end of the month, Ukraine had signed a 10-year air defense pact with all three Gulf states, built on a simple economic pitch: a batch of 1,000 interceptor drones costs up to $3.5 million, cheap next to a damaged data hall. Ukrainian firms have already set up ten “shadow” factories worldwide to build them.

Why Gulf Capitals Refuse to Blink

The case for relocating Gulf compute rests on a misreading of why these governments are spending in the first place. This isn’t venture capital chasing a quarterly return. It’s sovereign wealth financing a post-oil future, and sovereign wealth doesn’t flee when the shooting starts.

Mohammed Soliman, a senior fellow at the Middle East Institute, told Fortune that “the Gulf’s appetite for scale and speed gives Washington something rare: an external accelerator.” Energy is the other half of the pitch. Abu Dhabi and Riyadh offer industrial power priced five to seven times below Western rates, and the region backs that with an annual quota of 500,000 Nvidia chips a year under the framework Washington approved in 2025. Add geography: the Gulf sits roughly 2,000 kilometers from Mumbai, against 13,000 from Virginia, and that gap shows up directly in round-trip latency for AI inference, the metric that decides whether a service feels instant or not.

The money on the table makes retreat costly. Here is how the largest projects stack up right now.

None of the companies behind that table have walked away in public. Amazon Web Services CEO Matt Garman told reporters the company’s “excitement about investing long term in that region is just as strong as it’s ever been.” A G42 spokesperson, Abu Dhabi’s state-backed AI champion, said its “direction remains unchanged” and its “conviction has only deepened,” adding that infrastructure “has to absorb difficult periods without losing its shape.”

The Sovereignty Law That Blocked Its Own Escape Hatch

Here is the contradiction the war exposed. Gulf Cooperation Council states spent years passing data localization laws that keep sensitive public sector information inside national borders, a policy built around sovereignty. When Iran struck AWS facilities and hyperscalers advised clients to reroute workloads elsewhere, Gulf governments discovered they legally could not comply with their own vendors’ disaster recovery advice.

Data sovereignty, in other words, became a trap of its own making. One proposed fix borrows a diplomatic concept: the data embassy, a facility in a foreign country that stores a nation’s data under its own home-country legal protections. Estonia and Monaco already run them out of Luxembourg, and Saudi Arabia’s draft AI law includes a provision for hosting them. Mahmoud Abuwasel, a disputes partner at law firm Wasel & Wasel, called the model elegant because “it solves the physical peril of localizing data in an active conflict zone.”

Whether that legal fix arrives before or after the next strike is an open question, and the war’s own endpoint keeps shifting. An April 8 truce suspended the kinetic exchanges but resolved none of the underlying tension, and commodity traders have been just as unsettled: copper’s rebound on a claimed Iran settlement shows how quickly markets swing on a ceasefire that keeps not quite holding. Gulf states, meanwhile, were reportedly not at the table when that truce was negotiated.

What Does Hardening a Data Center Actually Cost

Physically protecting a data center against drones and missiles is not a line item the original investment case included, and estimates now put the added cost at roughly 5% of total construction spending, according to Guidepost Solutions consultant John Bekisz. On a market where JLL puts shell construction alone at close to $12 million per megawatt, that percentage adds up fast across a capacity set to triple to 3.3 gigawatts by 2030.

What that money actually buys is becoming clearer. Gulf operators and their hyperscaler partners are converging on a similar checklist:

• Earth berms and buried infrastructure – substations, transformers and fuel storage moved underground to defeat blast and fragmentation.
• Counter-drone detection – radar and jamming systems, a category where firms like DroneShield and Echodyne report a surge in inquiries directly tied to the AWS strikes.
• War-risk insurance – specialized coverage, since standard commercial policies typically exclude acts of war.
• Modular, compartmentalized design – redundant microgrids and automated failover so a facility can keep running at reduced capacity after a partial strike instead of going fully dark.

Matt McCrann, a former DroneShield executive who has worked with data centers in the U.S., put the new baseline bluntly: “Data centers are secondary targets right after obvious military sites.” CSIS director Aalok Mehta told CNBC the conflict has “shattered the illusion of long-term stability in the Gulf,” and predicted future facilities will simply be more expensive and slower to bring online.

Where Analysts Split on the Gulf’s Odds

• The cautious camp: Mehta and the Atlantic Council’s Ray argue facilities will need to be physically hardened or built underground, with higher insurance and longer timelines baked in for years.
• The confident camp: Humain CEO Tareq Amin calls Saudi Arabia’s “large geography” and “abundant energy resources” a strategic advantage that outlasts any single conflict, a view G42 echoes almost word for word.
• The skeptical camp: Foreign Affairs contributors argue there is “no realistic way to protect a commercial data center against cruise missiles or drone swarms,” making continued build-out a bet on a war that won’t stay contained.

Water adds a quieter complication to all three positions. Data centers in Saudi Arabia alone consumed 15 billion liters of water last year, a strain regulators were already managing before drone defense entered the budget conversation.

Announced Capacity Still Outruns What’s Built

Brent crude surged more than 55%, from around $72 a barrel to nearly $120, as the Strait of Hormuz closure became what the International Energy Agency called the largest oil supply disruption on record. UAE gas prices for consumers jumped 30% in April. Even the cheapest power on the planet isn’t immune to a war next door.

None of that has pulled the plug on the buildout. Pure Data Centres Group paused fresh investment decisions on its Abu Dhabi expansion, but no hyperscaler has cancelled built capacity, and new commitments keep landing alongside the caution. Bloomberg analyst Michael Deng put the lesson simply: “The biggest takeaway is that physical resilience was taken for granted for the longest time, even in the Gulf states.”

The Gulf’s standing as a global compute hub was never going to be settled by how many gigawatts get announced at a summit. It will be settled by how many are still running the morning after Iran’s next attack.