Control plane will almost always be impacted, I agree.

Our data plane was fine (for example, ec2 instances and s3 buckets in other regions were fine).

I have never had a production issue in other regions due to a us-east-1 outage. The worst that ever happened was I had to wait to update a Cloudfront distribution because the control plane (based in us-east-1) was down, but the existing configuration continued working fine throughout.

I don't know what the architecture of IAM looks like, but somehow it's never suffered a global outage.

AWS is really, really good at regional isolation.

>I don't know what the architecture of IAM looks like, but somehow it's never suffered a global outage.

Authentication possibly, but the control plane has gone down preventing changes.

I think the data plane is regional

I have.

Not being able to update your existing resources is still an outage from a DevOps perspective.

It might be an API level outage vs an end-user level outage from your customer's perspective, but if the functionality is down, it's an outage.

Usually it only prevents changes, but the runtime isn't affected.

I thought there was some recent shift on making IAM multi-region?

So much for redundancy I guess.