Six months after Iranian drone strikes damaged three AWS data centers in the UAE and Bahrain, Amazon still hasn’t restored full service to either region, and it won’t even provide a Bahrain update until early 2027. That single, unresolved outage sits inside a dataset of 30,246 cloud and SaaS outages that monitoring firm IncidentHub tracked across the first half of 2026 alone.
A Reliability Report With Uncomfortable Numbers
IncidentHub’s H1 2026 Cloud and SaaS Reliability Report counted those 30,246 outages across 1,082 monitored providers between January and June, with May alone accounting for 6,070 incidents. Only 15.9% of the providers IncidentHub tracks recorded zero outages during the period. Among major cloud providers, AWS and Microsoft Azure each logged 14 incidents, Google Cloud Platform logged two, including a data center fire in India that took 21 days and 12 hours to fully mitigate, and Oracle Cloud logged two. Edge and CDN providers fared worse in raw count: Cloudflare alone logged 487 outages in six months, against 161 for Fastly and 59 for Akamai.
Operational Impacts of Cloud Outages
Individual incidents carried real business consequences beyond the count. A Google Cloud automated system placed the developer platform Railway’s production account into suspension on May 19, cutting off every customer workload running on it for roughly eight hours. A ransomware attack by the group ShinyHunters against learning-platform provider Instructure knocked Canvas offline for an estimated 8,800 to 9,000 institutions right as many schools were entering final exams, with recovery at individual campuses ranging from a single day to more than a week. GitHub logged 169 incidents over the same six months, including an April 27 incident in which a surge of scraping traffic overwhelmed its search infrastructure and knocked out issue, pull-request, and Actions search company-wide for more than six hours.
Why This Differs From the Multicloud Debate Companies Already Know
Enterprise conversations about multicloud strategy have mostly focused on cost and lock-in: whether spreading workloads across AWS, Azure, and Google Cloud lowers vendor pricing power and eases the pain of switching providers later. IncidentHub’s numbers point toward a different argument. Workload concentration on a single provider, or on a single edge network like Cloudflare, isn’t a theoretical risk. It’s a documented, frequent operational event, one that can run from an eight-hour disruption to an outage that, six months on, AWS still hasn’t closed out.
Physical and Geopolitical Risk: The Recovery That Isn’t Finished
The Middle East strikes are the clearest illustration of why resilience planning has to account for physical and geopolitical risk alongside routine technical failure. A regional outage caused by drone strikes doesn’t fit the failover assumptions built around software bugs or hardware faults, and the recovery has borne that out. AWS’s UAE region, ME-CENTRAL-1, is still missing one of its three availability zones, and the company says it will share a restoration update in the coming months. Its Bahrain region, ME-SOUTH-1, hasn’t come back online at all, and AWS isn’t promising an update before early 2027. What the company described in March as a recovery measured in several months is now approaching a year for one region, with no fixed end date.
The Board Question This Data Actually Raises
My take: the resilience case for multicloud architecture is strong enough now that leaving it purely to whichever team owns cloud infrastructure undervalues the stakes involved. A single-provider outage lasting the better part of a year, or an edge-network incident disrupting thousands of downstream customers at once, is a business-continuity event with revenue, legal, and reputational consequences. That belongs in front of a board’s risk committee, not buried in an infrastructure team’s backlog.
Prioritizing Critical Workloads
None of this means every company needs full workload portability across three clouds. The operational overhead of maintaining that kind of redundancy is real, and for many businesses, it isn’t worth the cost. The more useful standard coming out of IncidentHub’s data is narrower: identify which specific workloads would cause the most damage if their single provider went down for days rather than hours, and build redundancy around those workloads specifically, rather than treating multicloud as an all-or-nothing architectural stance.
IncidentHub’s second-half 2026 numbers will show whether the incident rate is climbing or leveling off, but the first half already gives boards a concrete baseline to weigh against their own concentration risk. Thirty thousand outages in six months isn’t an argument for panic. It’s an argument for knowing, in advance, which workloads sit inside the outage count’s blast radius, because Bahrain’s customers already know what the worst case looks like: six months of silence, with the next word not due until 2027.
The post AWS’s Unfinished Recovery Is the Clearest Argument for Multicloud Yet appeared first on DataFLOQ.
