Cloud access becomes a critical issue

Data stored in the cloud is easily accessible, but the question of who controls access to it has become increasingly important. A company can lose access to its data after an incident or a geopolitical decision, making it vital for leaders to understand who actually controls this access.

AWS faces data access challenges

On September 15, 2026, Amazon Web Services (AWS) released a statement that many cloud customers found unexpected. The company could no longer restore access to certain customer data hosted in its Bahrain region, highlighting the risks associated with relying on cloud infrastructure.

Infrastructure damage disrupts services

Six months earlier, drone strikes during a conflict with Iran had damaged several AWS infrastructures in the United Arab Emirates and Bahrain. The damage exceeded what regional redundancy systems were designed to handle, leading to a complete unavailability of the Bahrain region by April 2026.

Data loss highlights vulnerabilities

AWS had advised customers to move their workloads to other regions as early as March 2026. Most had done so before the region went offline, but for those who did not, Amazon indicated it had exhausted all restoration options, resulting in permanent data loss.

Cloud's physical reality

The cloud is often seen as an invisible, omnipresent entity, but this incident reminds us that data are physically located on servers connected by cables and networks. The case of Bahrain underscores that behind the cloud lies a physical geography tied to the infrastructures that store and transmit data.

Data localization limits resilience

Some companies are subject to data localization laws that restrict where data can be moved. This case highlights that the more data are legally tied to a specific territory, the fewer geographic fallback options are available, potentially limiting resilience during incidents.

Legal and geopolitical constraints

The loss of access to data is not always accidental. In July 2025, the European Union sanctioned the Indian refiner Nayara Energy, and shortly after, Microsoft suspended the company’s access to services like Outlook and Teams, despite Nayara claiming to have paid its licenses.

Legal geographies intersect

This situation involved three legal geographies: European sanctions, American law, and Indian law. Nayara disputed Microsoft’s decision, arguing that neither American nor Indian law required the suspension. The issue was resolved when Microsoft restored access before a court hearing.

Cloud has multiple addresses

The cloud is often represented as a simple, amorphous symbol, but it has multiple addresses. These include the physical location of servers, the service providers, the jurisdictions to which these providers are subject, and the infrastructures that enable access.

Leaders must ask critical questions

For a leader, knowing where data are stored is essential. However, it is also important to consider how many countries and jurisdictions are involved in accessing those data. Leaders must be prepared to answer questions about alternative tools and the time needed to implement them in case of an access disruption.