Introduction
If you followed the setup guide on the Admin page, your
setup is already complete. You can skip directly to what’s next.
- Run queries in BigQuery to compute exposure and metrics.
- Store assignment data in BigQuery.
- Administrators who want to set up Confidence for their organization
In this tutorial, you create a service account in GCP that Confidence impersonates.
The service account used by Confidence is
account-<your-account-id>@spotify-confidence.iam.gserviceaccount.com.
You can name your service account anything you want.
For clarity, the tutorial assumes you create a service account called confidence.
You can read more about service account impersonation in the Google Cloud documentation.Before You Begin
- You need to have a Confidence account.
- You need to have a Google Cloud Platform account.
- You need to have permissions to create service accounts.
- You need to have the following APIs enabled in your Google Cloud Platform
project:
- BigQuery API
- Cloud Resource Manager API
Terraform Scripts
Terraform scripts are available to create the service account, setup permissions and create the required datasets. If you are using Terraform, then after you have applied the Terraform Configuration, you can skip directly to step Step 1c.Step 1: Prepare GCP and Create Data Warehouse Connection
In this step, you:- create a service account in GCP that Confidence impersonates
- create a dataset for storing the tables that Confidence generates
- configure a metrics data warehouse connection
Step 1a: Create Service Account
For Confidence to access BigQuery, you need to create a service account that has permissions to access BigQuery. You also need to allow Confidence to impersonate the service account. Follow these steps:Go to Google Cloud Platform Console
Go to the Google Cloud Platform Console and select the project you want to use for Confidence.
Navigate to Service Accounts
Enter service account details
Enter a name for the service account, for example,
confidence. Make note of the service account email address. You can click copy-to-clipboard icon to copy it. Click CREATE AND CONTINUE.Grant roles to the account
Grant the following roles to the account:
- BigQuery Job User
- BigQuery Data Viewer
Grant Confidence Access to Impersonate the Service Account
Confidence needs to be able to impersonate the service account you just created to be able to access BigQuery. You do this by granting one of Confidence’s own service accounts the “Workload Identity User” role, called the principal account:Open the service account details
Click on the service account you just created to go to the service account details page.
Enter the principal account
Enter
account-<your-account-id>@spotify-confidence.iam.gserviceaccount.com as principal.Step 1b: Create BigQuery Datasets to Store Metrics and Exposure
Confidence needs a dataset in BigQuery where it can store intermediate metrics and exposure calculations. For Confidence to access the dataset, you need to grant the principal service account access to the dataset.Go to Google Cloud Platform Console
Go to the Google Cloud Platform Console and select the project you want to use for Confidence.
Create a new dataset
In BigQuery, click ⋮ > CREATE DATASET next to the name of the project you want to create it in.
Select the dataset location
Select the location where you want to store the dataset.
The dataset location must be the same as the region of your Confidence account. The recommendation is to select a multi-region location for your dataset, like
EU or US.Grant permissions
Enter the email address of the
confidence service account you created and assign the role BigQuery Data Owner.Step 1c: Configure a Metrics Data Warehouse
With the completion of step 1a and 1b, you have now created a service account and a dataset in BigQuery. You can now configure Confidence to use BigQuery to compute metrics. To do so, follow these steps:Navigate to Metrics Data Warehouse settings
On the bottom of the left sidebar, select Admin > Connections > Metrics Data Warehouse.
Enter connection details
Enter the GCP Project ID, your metrics dataset (
confidence_metrics) and the email address of the confidence service account you created in step 1a.Step 2: Configure Confidence to Write and Read Assignment Data
In this step, you:- create a dataset in BigQuery that Confidence can write assignment data to
- configure a flag applied connector so that Confidence is able to write assignment data
- configure an assignment table so that Confidence is able to read assignment data
Step 2a: Create BigQuery Datasets to Store Assignment Data
If you want to use Confidence Flags to run experiments, you need to complete a few more steps to configure Confidence to store assignment data in BigQuery and an assignment table that reads from the BigQuery table. Confidence needs a dataset in BigQuery where it can store assignment data. For Confidence to access the dataset, you need to grant the principal service account access to the dataset.Go to Google Cloud Platform Console
Go to the Google Cloud Platform Console and select the project you want to use for Confidence.
Create a new dataset
Go to BigQuery and click ⋮ > CREATE DATASET next to the name of the project you want to create it in.
Select the dataset location
Select the location where you want to store the dataset.
The dataset location must be the same as the region of your Confidence account. The recommendation is to select a multi-region location for your dataset, like
EU or US.Grant permissions
Enter the email address of the
confidence service account you created and add the role BigQuery Data Owner.Step 2b: Configure a Flag Applied Connector
For Confidence to be able to store assignment data in BigQuery, you need to set up a connector between Confidence and BigQuery.Assignment data is information on which users were assigned to which variants
in the experiments you run. Assignment data goes into exposure calculations.
Metrics use exposure to calculate results in your tests.
Navigate to Flag applied connections
On the bottom of the left sidebar, select Admin > Connections > Flag applied connections.
Enter connection details
Enter the Project ID, the dataset (for example,
confidence_flag_applied) you created in step 2a and the email address of the confidence service account you created in step 1a.Enter the table name
Enter the name of the table (for example,
flag_applied) to write assignment data to. Confidence creates the table with the right schema for you.Step 2c: Configure an Assignment Table
For Confidence to use the stored assignment table, you need to set up an assignment table that reads from the BigQuery table. You first need to create an entity, which represents the thing you’re experimenting on, like your users. To do so, follow these steps:Navigate to the BigQuery connection
On the bottom of the left sidebar, select Admin > Connections > Flag applied connections and then the BigQuery connection you created.
Enter assignment table name
Enter a name for the assignment table, such as
flag_applied. This name should typically match the name you used in step 2b. Confidence can then read assignments from the destination table of your flag assignments.Create or select an entity
Create a new entity or select an existing entity. Entities are the things you’re experimenting on, like your users. Enter
User and specify the data type of the identifier that identifies the entity. For example, if you have a UUID that identifies your users, your primary key type is a String.Step 3: Grant View Access to Metrics Data Sources
Confidence uses fact tables to describe the data that you create metrics from. To ensure that Confidence can access data from the data sources you use for fact tables, you need to grant the role BigQuery Data Viewer to the service account namedconfidence that you have created.
Grant this role for the datasets and tables you want Confidence to have access to.
Go to Google Cloud Platform Console
Go to the Google Cloud Platform Console and select the project that the data you want to grant Confidence access to is in.
Select the dataset or table
Go to BigQuery and select the dataset. Optionally select the table.
Open permissions dialog
If you selected a dataset, click SHARING > Manage Permissions. If you selected a table, click SHARE.
Grant permissions
Enter the email address of the
confidence service account you created and assign the role BigQuery Data Viewer.