We actually found this out the hard way. We got DDoS'd and cloudwatch was our second most expensive item after API Gateway.

Lambda and Dynamodb were almost insignificant.