Skip to main content
idle · aws

Timestream databases with near-zero metered activity but standing storage charges

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

Timestream keeps billing for stored data (memory store and magnetic store by tier) long after ingest and queries stop. ZopNight calls a database idle when account-level metered bytes stay under 1 MiB across a fully-covered 30-day window, and prices the finding at the database's full standing monthly cost.

Signal and threshold

How ZopNight evaluates Timestream databases with near-zero metered activity but standing storage charges.
Field Value
Rule IDsRC-194
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourcetimestream_idle.go

Storage is the bill that outlives the workload

A Timestream deployment that stopped ingesting months ago has scaled its write and query charges to zero by itself, but the data it accumulated keeps billing by stored gigabyte in the memory and magnetic tiers indefinitely. Abandoned time-series databases are therefore a pure storage annuity paid for nothing, and deletion recovers the whole standing cost, which is exactly how the recommendation prices it: the aggregator’s measured monthly cost, never a flat guess.

A coarse signal, deliberately acknowledged

AWS publishes no per-database query-count metric. None of Timestream’s activity counters carry a database dimension; they aggregate at the account/region level with only an operation dimension. So the rule reads the account-level CumulativeBytesMetered series, which rises with both ingest and queries, and a below-floor reading means the entire regional footprint is quiet, not one database among busy ones. The finding is honest at that grain: it fires when nothing in the account is using Timestream at all.

Floors and coverage instead of zeros and hope

Exact-zero gating under-fires, because a dormant account still emits trickle metered bytes from stray metadata scans. The rule uses a 1 MiB floor on the window peak (orders of magnitude below any real workload) and demands a full 30 days of actual harvested data before deciding, stricter than the usual 7-day bar because the follow-up action is a destructive delete. Missing metrics, thin coverage, or an unpriced database each abstain.

Run the same measurement

Terminal window
aws cloudwatch get-metric-statistics \
--namespace AWS/Timestream --metric-name CumulativeBytesMetered \
--start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \
--end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--period 86400 --statistics Sum

Plan an exit, not just a cleanup

Amazon Timestream for LiveAnalytics is closed to new customers as of mid-2025, so an abandoned database here is doubly worth acting on: export anything with archival value, delete tables to stop storage charges, then the database. Point any surviving time-series need at Timestream for InfluxDB or another store rather than back at a product in wind-down.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·