The UAE is reviewing the design of its planned 5GW AI data centre project after Iranian missile and drone attacks damaged cloud infrastructure in the UAE and Bahrain, Reuters reported.

Originally planned as a 10-square-mile campus in Abu Dhabi, the project will now likely comprise a network of data centres spread across the UAE, according to people familiar with the plans.

Six people familiar with the discussions said the final design, construction costs, and potential effects on the project schedule have not been determined.

G42, the UAE-based technology company leading the project, said work on the AI campus was progressing as planned. “The project’s specifics are subject to continuous review in line with the security, resilience and operational standards expected of critical infrastructure at this scale,” G42 said in a statement to Reuters.

From cloud redundancy to physical attack

Measures under consideration include placing some infrastructure underground, using blast-resistant materials, adding backup power and cooling systems, and incorporating equipment designed to defend against drones and missiles. Facilities handling sensitive data are also being considered for locations inside mountains, according to people familiar with the plans.

The review follows physical damage to AWS infrastructure in the region earlier this year. AWS said two of its facilities in the UAE were directly struck by drones, while a strike near one of its Bahrain facilities caused physical damage to infrastructure. The strikes caused structural damage and disrupted power delivery, while fire-suppression activity resulted in additional water damage in some cases.

Two of the three Availability Zones in AWS’s UAE region were significantly impaired. Customers experienced degraded availability across services including EC2, S3, DynamoDB, Lambda, Kinesis, CloudWatch, and RDS.

AWS’s account of the disruption also showed how the loss of multiple zones affected a regional cloud service. Amazon S3 continued operating normally when one UAE Availability Zone was initially powered off because the service is designed to withstand the loss of a single zone. Error rates increased after the second zone became impaired, with AWS reporting high failure rates for data ingestion and retrieval.

AWS advised affected customers to direct S3 data to another region and later recommended that customers activate disaster recovery plans, recover from remote backups, and redirect applications away from the affected regions.

Cloud providers already use physical separation to limit infrastructure failures. AWS designs Availability Zones as separate failure domains with independent power, networking, and mechanical infrastructure, while Microsoft uses physically separated Azure zones with independent power, cooling, and networking.

AWS says Availability Zones are placed at meaningful physical distances from one another to reduce the risk of correlated failures while remaining close enough to support low-latency networking and data replication. Its architecture guidance lists utility outages, fibre disruption, fires, floods, and earthquakes among the events that physical separation is intended to contain.

The company’s Well-Architected Framework recommends considering multi-region disaster recovery when an event creates a risk of losing components across multiple Availability Zones. Microsoft similarly distinguishes between zone-level redundancy and architectures intended to protect workloads against a full regional outage.

On April 30, AWS said its UAE region was unable to reliably support customer applications because of damage from the conflict and recommended migrating accessible resources to other regions and restoring inaccessible resources from remote backups. AWS said the restoration process was expected to take several months.

Cloud services in the region remained disrupted as of September 11, based on the latest AWS updates available at the time.

Physical protection is also included in established information-security frameworks. The US National Institute of Standards and Technology’s SP 800-53 controls address physical and environmental protection and identify hostile attacks, natural disasters, structural failures, and human error among the threats organisations should assess when planning alternate processing capacity.

NIST recommends separating primary and alternate processing sites to reduce their exposure to the same threats, while noting that physical distance can be less relevant when the threat is a hostile attack. Its guidance also recognises geographically distributed architectures and cloud failover as options for maintaining processing capacity when a primary site becomes unavailable.

Reworking the 5GW AI campus

The UAE-US AI Campus was announced in May 2025 as part of a technology agreement between the two countries. The U.S. Department of Commerce said the site was planned to provide 5GW of AI data centre capacity in Abu Dhabi, with G42 leading its development alongside US technology companies.

The original announcement described a single campus spanning about 10 square miles. The Commerce Department said it would host US hyperscalers and approved cloud service providers, providing a regional platform from which those companies could offer services to markets within roughly 3,200km of the UAE.

The original plan called for nuclear, solar, and gas power. The revised plans point to a different physical configuration for later phases, with capacity potentially spread across several locations instead of remaining concentrated at one Abu Dhabi site.

The number of sites, their geographic separation, and the way power, networking, and compute capacity would be divided between them have not been disclosed. The proposed distributed design therefore cannot yet be directly compared with the Availability Zone architecture used by hyperscale cloud providers.

The first major deployment within the project is Stargate UAE, a 1GW compute cluster being built by G42. OpenAI has said the project involves Oracle, Nvidia, Cisco, and SoftBank.

Stargate UAE is a planned 1GW cluster within the wider 5GW UAE-US AI Campus. OpenAI said when it announced the project in May 2025 that the first 200MW was expected to go live in 2026.

Security requirements were already part of the original US-UAE agreement. The Commerce Department said the two governments agreed to controls covering access to advanced AI technology, including Know Your Customer procedures for organisations accessing the campus’s compute resources.

The Commerce Department said those measures were intended to prevent technology diversion and control access to the compute resources. The latest plans add a separate physical-security dimension covering the location, construction, utilities, and protection of the infrastructure hosting that capacity.

Construction of the first 1GW Stargate UAE phase has already begun. That phase is expected to continue with modifications intended to protect it against aerial attacks, while later capacity will likely be distributed across multiple locations if the revised plans proceed.

(Photo by Homa Appliances)

See also: Microsoft reportedly targets 38GW of data centre capacity by 2032

Want to learn more about Cloud Computing from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Cloud Computing News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.