Logistics & Supply Chain

One region fails, half the supply chain stalls

The 2025 AWS outage shows how regional cloud dependencies can put supply chain processes at risk.

By Alec Chizhik July 12, 2026 4 min read

One region fails, half the supply chain stalls

A DNS error in the AWS us-east-1 region triggered a chain of service disruptions on 20 October 2025. Functions dependent on that region were also affected. For companies with cloud-supported supply chains, it is therefore important to know which processes and services share a single point of failure. A tested recovery plan makes these dependencies visible.

Key takeaways

A DNS error affected the regional DynamoDB endpoint. The resulting chain of failures disrupted other AWS services in Northern Virginia.
Shared dependencies can put supply chain processes at risk. Companies should track which applications and service providers use the same cloud components for critical operations.
Recovery must align with business objectives. A second region can help if data, dependencies and failover are tested regularly.

A DNS error triggered a cascade of service disruptions

According to the AWS incident report, the starting point was a race condition in DynamoDB’s DNS management. It left an empty DNS record for the regional endpoint. The automated system could not resolve the error itself. New connections to the affected endpoint consequently failed.

After the DNS issue was resolved, dependent systems remained impaired. Among other things, the launch of new EC2 instances was disrupted. Later, faulty health checks on Network Load Balancers caused further connection problems. The initial DNS disruption lasted just under three hours, while the recovery of other services continued throughout the day.

Regional outages can extend beyond the region

Some functions dependent on us-east-1 were also affected, including functions of IAM and DynamoDB Global Tables. An application in another region is therefore independent of this particular failure path only if the services and operational processes it requires are also available there.

A list of a company’s own servers is insufficient for the analysis. It should also cover databases, identity services, DNS, interfaces and supplier services. For each critical process, it should be clear which of these components are needed for operation and which are needed for recovery.

Supply chains need clear recovery objectives

An outage can, for example, interrupt order processing or access to inventory data if the relevant applications depend on an affected cloud component. The extent of a disruption depends on the specific process and the alternatives available.

IT and business teams should define for each critical process how long it can be unavailable and how much data loss is tolerable. The AWS Well-Architected Framework calls these targets the Recovery Time Objective and Recovery Point Objective. Regular recovery and failover tests show whether the chosen architecture meets them.

Weighing multi-region and multi-cloud options

A second region with the existing provider can be a sensible step. This requires data and applications to be available there, and the switch must not depend on a failed component. A test should also check whether permissions, interfaces and operational tools work in the target region.

A second provider can reduce additional dependencies on the first provider. It also entails integration and operational work. The right solution depends on the recovery objectives, the actual shared dependencies and the resources available.

For financial entities within the scope of DORA, there is also a legal dimension: for proposed contracts for ICT services supporting critical or important functions, they must assess concentration risks, among other things. Article 29 refers to providers that are not easily substitutable and to multiple relevant contracts with the same or closely connected providers.

Frequently Asked Questions

What is cloud concentration risk?

Concentration risk arises, for example, when several critical processes depend on the same provider or a shared technical component. Its failure can then affect several processes at once.

Does a second cloud region protect against an outage?

It can protect against a regional outage if the application, data and required dependencies are available in the second region. A failover test checks whether recovery succeeds within the defined objectives.

What does DORA require regarding concentration risk?

When planning to use ICT services for critical or important functions, financial entities within its scope must assess, among other things, whether a provider is not easily substitutable or whether multiple relevant contracts exist with the same provider or closely connected providers.