Looks like RUNNING_SUM() has been added that does what your need:

Graph with RUNNING_SUM

You can find RUNNING_SUM() under "Add math"->"All functions"

There are two time periods to configure. The one above the chart is the time period that the chart will cover. The one above the metric, labelled "period" and next to "statistic" is the sample period over which the selected statistic is applied. In your use case this is sum over either 5 minutes or one hour. When hovering over the chart you're shown the time slot and the metric value over that time slot. If you move left or right you'll see a different time slot with it's own corresponding value. So if you change from a 5 minute to a one hour sample period, assuming your data is evenly distributed, you'll see a 12-fold increase in the sum. Changing the chart time period - the one at the top - will just show more of these 5 minute or one hour samples, but won't change the aggregation. The aggregation period can be set up to 30 days if that helps? There's the option of downloading the data as CSV if you need more control.

Cost explorer is the easier way to discover this.

You can use some arithmetic to obtain the previous value and then you're able to calculate the percentage of change as you want.

The value you want is: (value_now - value_before) / value_before

Breaking this into 2 parts:

1. Obtain value_now - value_before. This is the absolute delta of the values.
2. Obtain value_before. This is the value of the metric in the last datapoint.

Assuming that your metric in Cloudwatch is m.

Step 1: The absolute delta

The absolute_delta can be obtained with: absolute_delta = RATE(m) * PERIOD(m).

Step 2: The previous value

With some arithmetic it is possible to obtain previous_value. Given the definition of absolute delta:

absolute_delta = value_now - value_before

Since we have value_now = m and absolute_delta, then it's a matter of inverting the equation:

value_before = value_now - absolute_delta

Final equation

Just plug everything together and you have your final metric:

change_percentage = 100 * absolute_delta / value_before

In CloudWatch terms:

It is actually possible to implement the Alarm logic directly in CloudFormation.

Assuming to have two Scaling Policies ECSScaleUp and ECSScaleDown, the alarm definition will look like:

ECSWorkerSQSCumulativeAlarm:
  Type: AWS::CloudWatch::Alarm
  Properties:
    AlarmName: !Join ['-', [!Ref 'MyService', 'SQSCumulativeAlarm']]
    AlarmDescription: "Trigger ECS Service Scaling based on TWO SQS queues"
    Metrics:
      - Id: e1
        Expression: "fq + sq"
        Label: "Sum of the two Metrics"
      - Id: fq
        MetricStat:
          Metric:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Dimensions:
              - Name: QueueName
                Value: !GetAtt [ FirstQueue, QueueName]
        Period: 60
        Stat: Average
        Unit: Count
        ReturnData: false
      - Id: sq
        MetricStat:
          Metric:
            MetricName: ApproximateNumberOfMessagesVisible
            Namespace: AWS/SQS
            Dimensions:
              - Name: QueueName
                Value: !GetAtt [ SecondQueue, QueueName]
          Period: 60
          Stat: Average
          Unit: Count
        ReturnData: false
    EvaluationPeriods: 2
    Threshold: 100
    ComparisonOperator: GreaterThanThreshold
    AlarmActions:
      - !Ref ECSScaleUp
      - !Ref ECSScaleDown
    OKActions:
      - !Ref ECSScaleUp
      - !Ref ECSScaleDown

sum(), avg(), count(), min() and max() require the stats query command in front of them.

Try this:

fields @timestamp,srcAddr,dstAddr,srcPort,dstPort,bytes, interfaceId
| filter dstPort = 22
| stats sum(bytes) by interfaceId

Docs and sample queries