Deny all outbound traffic except cloudwatch on AWS

I have a server(Java/Tomcat running) which was creating huge outbound traffic. This server can not be accessed from outside world only internal network server can access it. i.e. inbound is allowed only from internal network.

To solve huge outbound traffic we have blocked all outbound traffic via aws security group except internal network servers.

But now it has also stopped aws custom monitoring scripts to send data to cloudwatch.

So what is the ip range that I need to open in outbound rules to send traffic to cloudwatch?