> ## Documentation Index
> Fetch the complete documentation index at: https://confidence.spotify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Export Data From Confidence

> Learn how to export data from Confidence using connectors.

export const HowToSchema = ({name, description, steps = []}) => {
  const schema = {
    "@context": "https://schema.org",
    "@type": "HowTo",
    name,
    description
  };
  if (steps.length > 0) {
    schema.step = steps.map((s, i) => ({
      "@type": "HowToStep",
      position: i + 1,
      name: typeof s === "string" ? s : s.name,
      text: typeof s === "string" ? s : s.text || s.name
    }));
  }
  return <script type="application/ld+json" dangerouslySetInnerHTML={{
    __html: JSON.stringify(schema)
  }} />;
};

<HowToSchema
  name="Export Data From Confidence"
  description="Learn how to export data from Confidence using connectors."
  steps={[
{
  name: "Authentication Setup",
  text: 'Confidence tries to avoid storing credentials for the connector destinations whenever possible. Instead, every Confidence account gets a unique GCP service account that\'s used to authenticate when writing to a destination. The procedure to configure the authentication differs between GCP and AWS. The next sections describe the authentication steps. - Create a service account with the required permissions - On the Permissions tab for the service account you just created in the GCP console, grant access to the principal account-@spotify-confidence.iam.gserviceaccount.com to impersonate the account by adding the "Workload Identify User" role to it.',
},
]}
/>

To export data Confidence has the concept of *"Connectors."* A connector takes events generated inside the Confidence platform (for example events specifying who got assigned to what experience) and forwards them to a destination.

Configure connectors in the **Admin** panel in [Confidence](https://app.confidence.spotify.com).

Three types of connectors are available. Each connector forwards different kinds of data:

* **Flag Applied Connectors** - These connectors export the assignment data.
* **Event Connectors** - These connectors export event data ingested through the Confidence event sender SDKs.
* **Platform Connectors** - These connectors forwards internal events to the customer's system. The events could for example be `MetricCalculationCompleted` or `WorkflowInstanceCreated`.

The connector destination can be either a warehouse such as BigQuery or Databricks, or a Pub/Sub topic or a Kinesis Stream that exists in your environment. When the data is in your warehouse, Confidence can query it by defining assignment and fact tables on top of the data.

## Authentication Setup

Confidence tries to avoid storing credentials for the connector destinations whenever possible. Instead, every Confidence account gets a unique GCP service account that's used to authenticate when writing to a destination. The procedure to configure the authentication differs between GCP and AWS. The next sections describe the authentication steps.

<Tabs>
  <Tab title="GCP">
    * Create a service account with the required permissions
    * On the Permissions tab for the service account you just created in the GCP console, grant access to the principal `account-<your-account-id>@spotify-confidence.iam.gserviceaccount.com` to impersonate the account by adding the "Workload Identify User" role to it.
  </Tab>

  <Tab title="AWS">
    For AWS Confidence uses [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) to securely authenticate without having to store any credentials.

    * Create a role with the required permissions in the AWS IAM Console. Specify the required permissions for each connector destination type.
    * Edit the trust relationship for the role, and allow the GCP Service Account to assume the role by using a definition that looks like this:

      ```json theme={null}
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Federated": "accounts.google.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
              "StringEquals": {
                "accounts.google.com:sub": "<GCP Service account ID>"
              }
            }
          }
        ]
      }
      ```
  </Tab>
</Tabs>