Timestream databases with near-zero metered activity but standing storage charges
What does ZopNight detect here?
Timestream keeps billing for stored data (memory store and magnetic store by tier) long after ingest and queries stop. ZopNight calls a database idle when account-level metered bytes stay under 1 MiB across a fully-covered 30-day window, and prices the finding at the database's full standing monthly cost.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-194 |
| Category | idle |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | timestream_idle.go |
Where it applies
Storage is the bill that outlives the workload
A Timestream deployment that stopped ingesting months ago has scaled its write and query charges to zero by itself, but the data it accumulated keeps billing by stored gigabyte in the memory and magnetic tiers indefinitely. Abandoned time-series databases are therefore a pure storage annuity paid for nothing, and deletion recovers the whole standing cost, which is exactly how the recommendation prices it: the aggregator’s measured monthly cost, never a flat guess.
A coarse signal, deliberately acknowledged
AWS publishes no per-database query-count metric. None of Timestream’s activity counters carry a database dimension; they aggregate at the account/region level with only an operation dimension. So the rule reads the account-level CumulativeBytesMetered series, which rises with both ingest and queries, and a below-floor reading means the entire regional footprint is quiet, not one database among busy ones. The finding is honest at that grain: it fires when nothing in the account is using Timestream at all.
Floors and coverage instead of zeros and hope
Exact-zero gating under-fires, because a dormant account still emits trickle metered bytes from stray metadata scans. The rule uses a 1 MiB floor on the window peak (orders of magnitude below any real workload) and demands a full 30 days of actual harvested data before deciding, stricter than the usual 7-day bar because the follow-up action is a destructive delete. Missing metrics, thin coverage, or an unpriced database each abstain.
Run the same measurement
aws cloudwatch get-metric-statistics \ --namespace AWS/Timestream --metric-name CumulativeBytesMetered \ --start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \ --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ --period 86400 --statistics SumPlan an exit, not just a cleanup
Amazon Timestream for LiveAnalytics is closed to new customers as of mid-2025, so an abandoned database here is doubly worth acting on: export anything with archival value, delete tables to stop storage charges, then the database. Point any surviving time-series need at Timestream for InfluxDB or another store rather than back at a product in wind-down.