I'm not too familiar with CloudWatch metrics, but I've been reading their docs. The default collection interval is 5 minutes, but you can increase it to 1 min to get more resolution. Metricbeat is collecting at 10 sec intervals by default. The differences could be caused by aliasing. Maybe you can try increasing the sampling interval to 1 min for the CloudWatch.
Is there a way to get the raw samples from CloudWatch in tabular form to compare to the raw samples from Metricbeat? Metricbeat is reporting the raw counter values from /proc/net/dev. CloudWatch is collecting its metrics from EC2 (not from a host agent). Since you have only one NIC I would expect the raw values to be similar (minus differences caused by sampling intervals not being aligned).
The number of packets received on all network interfaces by the
instance. This metric identifies the volume of incoming traffic in
terms of the number of packets on a single instance. This metric is
available for basic monitoring only.