Which GCP services changed the most month over month?

-- Replace the table with your billing export.
-- This scans real data: filter the partition column first. The filter starts
-- a day before the first of the month before last, so both complete invoice
-- months are read in full; a fixed window such as 70 days cuts off the start
-- of the earlier month and makes every service look like it grew.
WITH monthly AS (
  SELECT
    invoice.month                                            AS invoice_month,
    service.description                                      AS service,
    SUM(cost)                                                AS cost,
    SUM(IFNULL((SELECT SUM(c.amount) FROM UNNEST(credits) c), 0)) AS credits
  FROM `PROJECT.DATASET.gcp_billing_export_v1_XXXXXX_XXXXXX_XXXXXX`
  WHERE _PARTITIONTIME >= TIMESTAMP(DATE_SUB(
          DATE_SUB(DATE_TRUNC(CURRENT_DATE(), MONTH), INTERVAL 2 MONTH), INTERVAL 1 DAY))
  GROUP BY invoice_month, service
)
SELECT
  service,
  ROUND(SUM(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 2 MONTH)), cost, 0)), 2) AS prior_month,
  ROUND(SUM(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 1 MONTH)), cost, 0)), 2) AS last_month,
  ROUND(
    SUM(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 1 MONTH)), cost, 0))
  - SUM(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 2 MONTH)), cost, 0)), 2) AS delta,
  ROUND(SUM(IF(invoice_month = FORMAT_DATE('%Y%m', DATE_SUB(CURRENT_DATE(), INTERVAL 1 MONTH)), credits, 0)), 2) AS last_month_credits
FROM monthly
GROUP BY service
ORDER BY ABS(delta) DESC
LIMIT 50;