# Amazon CloudWatch Metric Stream

> CloudWatch metric streams bill per metric update pushed to the destination, plus Firehose delivery charges downstream. A stream configured for all namespaces meters the entire account's metric volume. ZopNight discovers streams on the 6-hour cycle, tracks streaming cost from Cost Explorer or CUR 2.0, and recommends tighter namespace filters.

Source: https://zop.dev/integrations/aws/cloudwatch-stream
Updated: 2026-08-19

---

A CloudWatch metric stream continuously exports metrics to destinations such as Firehose and third-party observability platforms, billed per metric update streamed. Streams configured to send all namespaces generate charges proportional to the whole account's metric volume.

## Charged per update, multiplied by scope

The meter counts metric updates: every datapoint of every metric the stream's filter admits, billed per thousand updates, with the Kinesis Data Firehose doing the delivery billing separately per GB. Scope is therefore everything. A stream filtered to a handful of namespaces meters a trickle; a stream configured for all namespaces meters every metric the account produces, and its cost automatically tracks estate growth, autoscaling churn, and every new service that starts emitting. The stream that feeds a third-party observability platform is usually the single largest CloudWatch line item in accounts that have one.

## Filter-scope analysis by ZopNight

Streams are discovered via a dedicated provider on the 6-hour cycle, and streaming cost is tracked from Cost Explorer or CUR 2.0. The recommendation class is filter scope: streams admitting namespaces no downstream dashboard or alert consumes, include-all configurations created during a vendor onboarding because the setup wizard defaulted to everything, and duplicate streams shipping overlapping namespace sets to the same destination. Tightening the include list is the rare cost fix that also improves the downstream tool by removing noise.

## Where streaming spend gets away

Vendor integrations are the origin story: Datadog, New Relic, and similar platforms document an all-namespaces stream as the quick start, and the quick start ships to production unedited. Growth does the rest. The stream's cost doubles when the fleet doubles, with no configuration change to alert anyone. Abandoned destinations are the terminal case: a stream still paying per update to feed a Firehose whose consuming platform was churned off months ago.

## Confirming what a stream sends

CloudWatch's Metric streams view (under Metrics) lists each stream with its filter configuration and Firehose destination. The include/exclude namespace list is the whole audit: comparing it against what the destination platform's users actually query identifies the namespaces paying rent for nothing.