Cloud Service Centers in the Middle East & North Africa To What Extent Do the Region’s Countries Depend on American Companies — and Why Does It Matter?
Data obtained and analyzed by “Arabi Post” on the map of cloud service centers and regions (data centers) in the Middle East and North Africa revealed that the region’s countries rely heavily on American companies for cloud services. The data shows the presence of around 31 American centers, most of them in Gulf countries, while the number of centers owned by Chinese companies reached about 7.
Across the sample analyzed (22 countries/89 cloud centers), American companies account for around 35% of cloud presences in the Middle East and North Africa. In the Gulf countries, more than 53% of the cloud infrastructure tracked there is American. Iran, meanwhile, appears to be an exceptional case among all the region’s countries, as it relies entirely on a 100% local cloud ecosystem.
89
cloud centers across 22 countries
35%
American companies’ share (31 centers)
53%
Gulf reliance on U.S. companies
100%
Iran’s reliance on a local ecosystem
Interactive map of cloud service centers in the region
89 cloud service centers and regions across 22 countries in the Middle East and North Africa. Click on any point to view details about the center, including the operating company, its nationality, and the year it was launched. Use the filters to focus on a specific nationality, or search for a particular center or country.
Source: “Arabi Post” database of cloud service centers in the Middle East and North Africa (89 centers). Locations are approximate at city level for display, and nearby points may be slightly offset to avoid overlap.
Cloud Service Centers: To What Extent Do the Region’s Countries Depend on American Companies, and Why Does It Matter?
Within a few years, cloud service centers have shifted from a “technical option” for reducing server costs into critical infrastructure for the state and the economy: e-government portals, payment and banking systems, health and education platforms, and the operation of big data, artificial intelligence, and more. But the recent Iran war (2026) revealed a new dimension: the cloud itself can be directly and physically targeted, as happened when Iranian drone strikes damaged Amazon AWS cloud service data centers in the UAE and Bahrain, causing disruptions and service outages. This exposed the vulnerability of a sector worth around one trillion dollars globally to human attacks or natural disasters, and also revealed the extent of the region’s dependence on American companies providing cloud services.
But the significance of American and foreign companies does not stop at technical competition or service quality; it extends to digital sovereignty and questions of control over data for these countries and their various sensitive sectors. American companies are subject to U.S. laws regulating lawful access to data, such as the CLOUD Act, raising questions about the limits of judicial requests for data even when it is stored outside the United States.
From the official text of the U.S. “CLOUD Act” (March 2018): Section §2713 explicitly compels communications and computing service providers to preserve and disclose subscriber data within their “possession, custody, or control, regardless of whether it is located within or outside the United States” — confirming the point above. (Click an image to view it full size.)
This dependence also intersects with the context of cross-border intelligence gathering under frameworks such as FISA Section 702, as presented by U.S. government agencies. At the same time, experts contacted by “Arabi Post” warn of the risks of concentrating contracts with American cloud service providers, and of the impact of “foreign jurisdiction” on privacy and security. Between concerns over sovereignty and the market’s need for ready-made infrastructure, the importance of data localization policies and the limits of cross-border data flows is growing, as discussed in international reports such as those by the OECD.
Expert comment
Ibtihal Abu Al-Saad
Programmer and former Microsoft employee
Ibtihal Abu Al-Saad, a programmer and former Microsoft employee, told Arabi Post that under laws such as FISA Section 702 and the CLOUD Act, there are legal risks related to surveillance of these countries, their citizens, and even U.S. citizens or residents who interact with individuals or organizations in those countries where data centers operated by American companies store the data of those nations and their citizens.
To understand the scope of this risk, it is necessary to first examine U.S. federal laws such as FISA Section 702 and the CLOUD Act, which governs U.S. authorities' access to data stored on the servers of technology companies both inside and outside the United States. Although the CLOUD Act grants Washington broad authority to access data stored in data centers—the large-scale infrastructure used by companies to store and process information—in some cases, under the Act, U.S. authorities may be required to notify the government of the country concerned that there is a legal basis compelling access to that data.
Abu Al-Saad illustrates this with an example: if a dispute were to arise in the future between a Gulf state and the United States, Washington could impose sanctions on that country and its citizens—similar to those imposed on Iran—and sanction specific individuals based on information obtained from the stored data. The U.S. government could also penalize or target any U.S. citizen who engages in financial transactions with that country or sends money transfers to people there.
Abu Al-Saad also says that if a dispute were to occur between that country and Washington, the United States could suspend its data storage services for that country and justify doing so. This could result in prolonged service disruptions, as well as significant costs and lengthy delays in migrating data to alternative local cloud data centers to prevent services from failing or collapsing. This would affect all sectors, including financial and banking services.
Silent Breach and Total Secrecy: How Do U.S. “National Security Letters” Threaten Countries’ Digital Sovereignty?
In the context of the security risks linked to countries’ reliance on American data centers, another point also emerges—one that Ibtihal Abu Al-Saad considers the most important and most dangerous: the U.S. legal and intelligence tool known as “National Security Letters” (NSLs).
These letters are secret administrative subpoenas issued by U.S. federal intelligence and security agencies. Under these letters, U.S. authorities have the ability to compel major technology companies to hand over sensitive data related to citizens or countries. Washington could, for example, force Amazon to open data records belonging to users in Saudi Arabia, Qatar, Bahrain, or elsewhere, while “imposing a strict nondisclosure order that prevents the technology company from notifying the Bahraini government or the targeted individuals that this access has taken place. This mechanism ensures monitoring and espionage with absolute secrecy and the utmost seriousness.”
““National Security Letters eliminate any obligation of transparency or prior notification when accessing any data. They operate as a shield that ensures no information about surveillance or espionage operations is disclosed.””
— Ibtihal Abu Al-Saad, programmer and former Microsoft employee
In other words, these NSLs eliminate any obligation of transparency or prior notification when accessing any data. While the CLOUD Act may leave a narrow margin for foreign governments to know that their citizens’ data is being examined, National Security Letters serve as a cover that ensures no information about these surveillance and espionage operations is leaked. This is what makes highlighting this legal loophole extremely important when assessing the sovereign risks of governments in the region relying on foreign cloud infrastructure.
For its part, the U.S. Department of Justice explains that the CLOUD Act has enabled bilateral executive agreements to facilitate access to data in cases involving “serious crimes,” within safeguards to protect rights. By contrast, providers such as AWS offer a defensive interpretation regarding privacy, with Amazon saying there is “no automatic access to data,” and stating that it has not disclosed the content of government/institutional customers stored outside the United States to the U.S. government, according to its compliance page, while pointing to “technical and legal layers of protection” from the company’s perspective.
Data Analysis: What Do These Tables Show?
Around 35% of cloud service centers in the region belong to American companies, totaling 31 centers, while Chinese-owned centers account for about 8%, with 7 centers. Iran, meanwhile, relies entirely on four domestic companies, giving it 100% local cloud infrastructure. Overall, 42% of the region’s cloud services are provided by local or various multinational companies.
The Gulf Arab states rely on American companies for 53% of their cloud services and on Chinese companies for about 12%. Overall, every Gulf country has a U.S. cloud presence.
Israel relies 100% on American providers, including Microsoft, Google, Amazon, and Oracle.
Iran: The cloud ecosystem is effectively localized. The research clearly found that the Iranian state has, over the years, built an infrastructure that keeps critical services operating domestically even if international connectivity is cut off through the National Information Network (NIN). This means the backbone of sovereign services is designed to function locally through companies such as ArvanCloud, which is subject to U.S. sanctions.
More than half of the cloud deployments in the region (51%) were launched after 2020, with 46 centers out of a total of 89 established during that period.
Distribution of centers by company nationality
89 centers — each nationality’s share of total presences
Companies with the largest share of centers
Number of presences/centers in the region
Number of centers per country
Total cloud presences per country
Distribution of centers by sector
Declared service type/sector
Number of Data Centers in Each Country and Their Distribution by Nationality
#
Country
Location
Center name
Operator
Nationality
Owner
Year
Classification
Coverage
AZ
Hypothesis and Methodology
The investigation focused on studying all cloud service centers in the Middle East and North Africa region, across their three classifications in terms of size and capacity to provide services:
Major cloud / hyperscaler.
Local cloud / local data center.
Cloud acceleration and interconnection point.
All hyperscaler centers are operated by global companies such as AWS, Azure, Google, and Oracle, most of which are located in the Gulf states and “Israel.” Other countries store their data in local government data centers or local telecom-company data centers, which fall within the second and third tiers of the classifications.
International institutions such as the World Bank indicate that investment in hyperscale centers—designed for massive, highly scalable processing and storage workloads—in any given country requires several key conditions, most notably: large market demand, stable and relatively inexpensive electricity and large cooling systems, highly reliable international connectivity through fiber and submarine cables, as well as political and security stability, a business environment that allows recovery of a massive investment, and clear regulatory frameworks that build trust in cloud services. In cases of conflict or sanctions—as in Syria and Yemen—barriers increase because of compliance restrictions and damage to infrastructure.
What are cloud service centers?
Cloud computing services are a model that enables “on-demand” access to shared computing resources (networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal administrative effort. In practice, the “cloud” is based on data centers grouped within:
Cloud regions: usually a geographic area within a country/city.
Availability Zones: several separate sites/data centers within the region, designed to reduce single points of failure, with separation in power, cooling, physical security, and low-latency network connectivity.
There are also layers of cloud services or service delivery models (IaaS/PaaS/SaaS) and deployment and usage models (public/private/hybrid/community), which are an important part of understanding and assessing risks and sovereignty over cloud service centers in the countries that host them.
What do states and governments use them for?
States usually use cloud service centers for three major purposes:
Modernizing public services (Digital Government): moving services to flexible, scalable platforms, such as government portals, digital identity, customs and taxation, and municipal services, while improving launch speed and service continuity.
Data analytics and artificial intelligence: cloud centers provide massive computing and storage capacity to run data analytics for states and governments, machine learning, and AI workloads that require specialized and large-scale hardware. This, for example, is one reason behind the race by data centers and AI to establish a presence in the Gulf and provide services there.
Resilience and business continuity (BC/DR): running backups, maintaining their durability, disaster recovery, and distributing infrastructure services (for both the private and public sectors) across more than one site. This is the logic behind designing availability zones within a region, or across multiple regions when laws allow.
What type of data is usually stored in cloud service centers?
The type of cloud service use depends on each country’s policy and its data classification, but the most common patterns in the public sector include:
Identity and civil registry data: personal data, documents, residency records.
Public financial data: taxes, customs, and government procurement.
Health and education services: patient files, appointment systems, education platforms.
Operational data for cities and infrastructure: the Internet of Things, sensing, traffic, energy/water.
Security, judicial, and even military agency data: often heavily restricted and isolated, or special/sovereign environments are built for it depending on classification sensitivity.
This is where the importance of deployment models (private/hybrid cloud) becomes clear: many governments tend toward a hybrid approach—partly on a public cloud for less sensitive workloads, and partly on a private/sovereign cloud for more sensitive ones. Cybersecurity guidance, such as that of the UK’s NCSC, also emphasizes that safe use depends on choosing the provider and configuring usage according to the “shared responsibility model” (part of the responsibility lies with the provider, and part with the customer, meaning the government).
Does the presence of American cloud centers in the region and the Gulf increase the risk of “targeting” by Iran?
The RUSI research institute says that the targeting of data centers in the Gulf on March 1, 2026 created global doubts about the resilience, sovereignty, security, and fragility of these centers, noting that data centers may be treated as strategic assets and “critical infrastructure,” especially if they are believed to support defense/intelligence capabilities alongside civilian services.
Iran threatened to target “economic centers and banks” linked to American/Israeli entities, and a list including major technology companies was discussed within the framework of “new targets,” according to media outlets linked to the Revolutionary Guard.
February 28, 2026
U.S.-Israeli strikes targeted sites inside Iran, including cloud service data centers in Tehran, which formed the context for the escalation.
March 1, 2026
Three cloud service facilities owned by the American company Amazon AWS in the UAE and Bahrain were damaged as a result of Iranian drone strikes. The strikes caused structural damage, disrupted power delivery, and in some cases fire suppression systems caused water damage inside the facilities. After its centers were targeted, Amazon said it worked with local authorities to contain the Iranian shelling and moved its employees to other areas.
March 11, 2026
Iran threatened to target 29 sites in the region representing the infrastructure of the American technology giants in the region, including cloud service centers.
What is the danger of targeting cloud service centers?
The danger is not just “losing files,” but digitally disabling and paralyzing states. It can be summarized in five points:
Critical service outages (Availability Shock): If banks, payments, public service platforms, or major companies depend on the affected region, the disruption quickly affects the public and the economy. RUSI pointed to broader disruption to financial and consumer services after the Gulf strikes.
Domino effect (Concentration Risk): The cloud encourages the aggregation of many services in one place. If that “place” is hit, many sectors are affected at the same time. AP warned that the rapid growth of data centers is matched by their exposure to risks in conflict zones.
“Rapid migration” due to residency and sovereignty laws: In theory, you can move workloads to another region, but in practice laws may prevent some data from leaving the country. Euronews quoted experts as saying that the portability of processing is constrained by “data localization/sovereignty” rules.
Fragility in the face of non-cloud bottlenecks: Even if data centers are not bombed, submarine cables and international connectivity can cause severe congestion/degradation in cloud services. Example: cuts to cables in the Red Sea affected Azure routes and increased latency in South Asia and the Gulf.
What is the size of spending on the cloud services industry globally and regionally?
The cloud services industry represents a huge global market, and spending on it is steadily increasing year after year with the development and expansion of artificial intelligence services. IDC, a leading global provider of market research and data analytics, expects global spending on the public cloud to exceed one trillion dollars in 2026 and for that figure to nearly double by 2029.
Regionally, Gartner, the research, consulting, and information technology firm, expects IT spending in the Middle East and North Africa to reach 169 billion dollars in 2026, and states that “data center systems” are the fastest-growing industry, estimated at 12.984 billion dollars in 2026. McKinsey, meanwhile, describes public cloud centers in the Middle East as a “multibillion-dollar opportunity” linked to digital transformation and one that is highly scalable.
+1
trillion $ expected global public-cloud spend in 2026
169
billion $ MENA IT spending in 2026
12.98
billion $ MENA data-center systems market in 2026
51%
of centers launched after 2020 (46 centers)
Gulf States’ Contracts with American Cloud Service Companies
Regarding the contracts Gulf states sign with American cloud service providers, in most cases the value of detailed government contracts with cloud providers is not disclosed. This is either because they are variable consumption-based contracts, framework agreements, or part of broader procurement portfolios (digital transformation) that are not publicly itemized. However, the following can be identified:
Saudi Arabia
According to a news report published by Arab News last year, the value of government contracts in the ICT (Information and Communications Technology) sector reached SAR 38 billion in 2024 (approximately US$10.13 billion), with a focus on cloud computing and artificial intelligence as priorities. These figures provide an indication of Saudi Arabia’s overall government digital spending (not cloud contracts alone).
In 2024, Amazon announced the construction of two cloud regions in Saudi Arabia at a cost exceeding US$5.3 billion. In the same year, Oracle also announced the launch of a second public cloud region in Saudi Arabia to “strengthen the AI economy,” with an investment of US$1.5 billion.
United Arab Emirates
In March 2025, the Abu Dhabi government announced its goal of automating 100% of government operations, supported by an investment of up to AED 13 billion (US$3.54 billion) in digital infrastructure under the Digital Strategy 2025–2027, alongside sovereign cloud agreements with Microsoft and Core42.
In November 2025, Microsoft announced that it would invest more than US$15.2 billion in the UAE between 2023 and 2029, including the construction and operation of advanced AI and cloud computing data centers.
Qatar
In November 2025, the state-owned company qnbn announced the signing of a multi-year contract with Microsoft to provide cloud computing services aimed at “accelerating digital transformation and artificial intelligence,” though the contract’s value was not disclosed.
This followed an announcement by Qatar’s Ministry of Communications and Information Technology in 2024 that it had signed an agreement with Microsoft Azure—whose value has likewise not been publicly disclosed—to migrate all government services to the cloud.
American Cloud Service Companies in the Service of the Israeli Military
The centerpiece of this presence is Project Nimbus, a cloud computing and artificial intelligence contract between the Israeli government and Google Cloud and Amazon Web Services (AWS). Announced in 2021, the project is valued at approximately US$1.2 billion and is intended to provide dedicated services to the Israeli government and military. It was officially declared operational in August 2023 with three Availability Zones.
The Israeli government selected AWS and Google for Project Nimbus as a multi-year program to provide a comprehensive cloud solution for the public sector, explicitly stating that it is primarily intended for the military and defense establishment, with the creation of local cloud sites to keep data within Israel’s borders in accordance with security guidelines.
Regarding publicly acknowledged and documented military uses, Microsoft acknowledges a commercial relationship with the Israeli Ministry of Defense that includes providing Azure and Azure AI services. The company says it conducted “internal and external reviews” following the war of genocide in Gaza. In a subsequent official update, Microsoft announced that it had “disabled a set of services/subscriptions for a unit within the Ministry of Defense after reviewing allegations related to the use of cloud storage and AI services.”
In May 2025, The Guardian reported that the Israeli military uses Azure to store telephone call data files obtained through extensive or mass surveillance operations targeting civilians in Gaza and the West Bank. Microsoft’s standard terms of service prohibit this type of use.
Source: Arabi Post database and analysis of cloud service centers (data centers) in the Middle East and North Africa—a sample covering 22 countries and 89 cloud centers. The figures are based on the official pages of providers (AWS, Microsoft Azure, Google Cloud, Oracle OCI, and others), as well as reports by organizations including the World Bank, IDC, Gartner, McKinsey, RUSI, and the OECD, in addition to interviews conducted by Arabi Post.
