Iranian Shahed drones struck two Amazon Web Services data centers in the United Arab Emirates before dawn on March 1, sparking fires and knocking out banking apps across a region of 50 million people. With little warning, the Gulf's AI infrastructure transformed from a commercial asset to a battlefield target.
This targeting was a consequence of strategic choices. Gulf states decided to side with America over China to build out their AI infrastructure, and Washington chose to use that infrastructure to support its military operations in the region. Iran concluded that data centers were fair game.
To understand how Gulf data centers became military targets, we have to understand how they became militarily useful in the first place.
During his May 2025 Middle East tour, Trump secured over $2 trillion in investment pledges; AI-related commitments were framed as an opportunity for the Gulf to diversify its economy away from oil. Microsoft committed $15.2 billion in the UAE, and Amazon pledged $5.3 billion for several new Saudi data centers. The Stargate UAE campus — a 5-gigawatt AI cluster across 7.3 square miles of Abu Dhabi desert — was presented as the international flagship, even if many details remained vague.
What the press releases omitted, however, was the military logic embedded in each deal. As a condition for receiving U.S. chip export approvals, the UAE's G42 and Saudi Arabia's Humain were required to phase out Huawei hardware and divest from Chinese technology platforms. Analysts called it “Compute Diplomacy”; in practice, it functioned more like a loyalty test. G42 became one of only two non-American firms on the IRGC's subsequent target list. It earned that distinction by choosing the American side.
Reports confirmed that Anthropic's Claude, which runs on AWS infrastructure, was used for intelligence assessments and target identification during Operation Epic Fury. The same cloud hosting Gulf banking and civil services was simultaneously processing targeting data for a war that the Gulf states had not explicitly endorsed and had privately signaled concerns about, despite hosting U.S. bases — creating a source of tension.
This is the structural fact the ceasefire has not resolved. Gulf data centers are dual-use not because their owners chose to make them so, but because U.S. strategic doctrine made civilian AI infrastructure inseparable from military operations over time. The IRGC's decision to strike AWS facilities — and publish a list of 29 tech targets across the region — followed the logic of the architecture Washington built and pressured the Gulf to host.
Gulf states sought data sovereignty, but what they got in practice was closer to its inverse.
Throughout the early 2020s, GCC members enacted data localization laws requiring sensitive public-sector data to be stored within national borders. The rationale was reasonable: to protect state data and reduce dependence on foreign infrastructure. But the practical consequence was that, when Iran struck AWS facilities and hyperscalers advised clients to reroute data elsewhere, Gulf governments found they legally could not comply. Their most sensitive data was anchored to the exact facilities under attack.
The sovereignty trap has a second dimension, too. By aligning exclusively with U.S. AI partnerships — cutting out Chinese providers, as Washington demanded — Gulf states eliminated the one form of technological diversification that could have hedged their exposure. Iran did not target Chinese data centers in the Gulf. It did strike AWS facilities, which hosted both civilian regional workloads and U.S. intelligence applications, rendering them legitimate targets in Iran’s eyes.
Early in the conflict, Gulf states made clear they had not been consulted before Operation Epic Fury began, which created resentment. They were given no voice in a decision that turned their territory into an active war zone. Even the April ceasefire brokered by Pakistan was reportedly negotiated without Arab Gulf state partners at the table, which added to the perception of exclusion.
Gulf populations — nine in 10 of them expatriate workers with no stake in the U.S.–Iran confrontation — found themselves unable to pay for taxis, access bank accounts, or order food. This happened as a direct consequence of a war their own governments had lobbied Washington to prevent.
Researcher Zachary Kallenborn of King's College London had already warned that, if data centers become critical hubs for transiting military information, they will increasingly be targeted by both cyber and physical attacks. This is precisely what happened in practice. The U.S. military's use of commercial cloud infrastructure for offensive operations is a feature of how modern warfare is now conducted.
The April 8 truce suspended kinetic attacks, but it resolved none of the structural conditions that produced them. The Strait of Hormuz remains contested, and Iran retains its nuclear program in whatever degraded form it exists today. And there’s reason to think Iran would restart attacks on AI infrastructure if the war resumes. A few days before the ceasefire began, IRGC Brigadier General Ebrahim Zolfaghari published satellite imagery of the Stargate campus days before the ceasefire and said, “Nothing stays hidden to our sight.”
The financial damage is real and visible. Pure DC (Pure Data Centres Group), a UK-headquartered hyperscale data center developer and operator backed in part by American funders, paused investment decisions on its Abu Dhabi expansion and broader Middle East pipeline because of the conflict.
Of course, big institutional investors have not run away from the Gulf. Brookfield, one of the world’s largest investors, confirmed that its $20 billion AI partnership in Qatar will continue as planned. But the rules and conditions of these deals have changed permanently.
Projects now cost more and carry stricter requirements. Insurance has become much more expensive. Investors are demanding higher returns to cover the increased risk. There is also more focus on security, physical protection, and backup systems. Deals are moving more slowly and more carefully than before. In short, the money is still coming, but the Gulf projects are no longer seen as low risk. The conflict has made everything more expensive and rendered all actors more cautious.
More significant however is what has not been reckoned with fully. The Gulf countries’ big AI and data center push assumed that huge amounts of money would be enough to succeed. They invested tens of billions of dollars, believing that pouring money into American-led projects would protect them from geopolitical risks. They did not fully prepare for the possibility that Iran would see these projects as U.S.-linked targets and attack them.
The Iran war demonstrated at considerable cost to Gulf civilian populations and their digital economy that “Compute Diplomacy” contained a military logic never fully disclosed to the states that hosted it. The Gulf was not simply invited to join a global AI economy; it was incorporated into American strategic infrastructure. The dual-use nature of these facilities made them vulnerable to attack. The invitation came with conditions — no Huawei, strict security protocols, formal alignment — that entrenched the entanglement, and the targeting followed.
Washington must reckon honestly with this dynamic. If commercial AI infrastructure in a partner state will be used for U.S. military targeting operations, that partner has a reasonable interest in knowing it and in being consulted beforehand. The consultation did not happen before Operation Epic Fury, and the Gulf absorbed the cost. Whether the next phase of AI investment will be built on different terms is the defining question of this ceasefire — not merely for tech but for what U.S. partnerships in the region actually mean.
The cloud has an address, and Washington has a responsibility to the people who live near it.