Which GCP services changed the most month over month?

-- Replace the table with your billing export.
-- This scans real data: filter the partition column first.
WITH monthly AS (
  SELECT
    invoice.month                                            AS invoice_month,
    service.description                                      AS service,
    SUM(cost)                                                AS cost,
    SUM(IFNULL((SELECT SUM(c.amount) FROM UNNEST(credits) c), 0)) AS credits
  FROM `PROJECT.DATASET.gcp_billing_export_v1_XXXXXX_XXXXXX_XXXXXX`
  WHERE _PARTITIONTIME >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 70 DAY)
  GROUP BY invoice_month, service
)
SELECT
  service,
  MAX(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 2 MONTH)), cost, 0)) AS prior_month,
  MAX(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 1 MONTH)), cost, 0)) AS last_month,
  ROUND(
    MAX(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 1 MONTH)), cost, 0))
  - MAX(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 2 MONTH)), cost, 0)), 2) AS delta
FROM monthly
GROUP BY service
ORDER BY ABS(delta) DESC
LIMIT 50;