Export Data From Confidence - Confidence Documentation

To export data Confidence has the concept of “Connectors.” A connector takes events generated inside the Confidence platform (for example events specifying who got assigned to what experience) and forwards them to a destination. Configure connectors in the Admin panel in Confidence. Three types of connectors are available. Each connector forwards different kinds of data:

Flag Applied Connectors - These connectors export the assignment data.
Event Connectors - These connectors export event data ingested through the Confidence event sender SDKs.
Platform Connectors - These connectors forwards internal events to the customer’s system. The events could for example be MetricCalculationCompleted or WorkflowInstanceCreated.

The connector destination can be either a warehouse such as BigQuery or Databricks, or a Pub/Sub topic or a Kinesis Stream that exists in your environment. When the data is in your warehouse, Confidence can query it by defining assignment and fact tables on top of the data.

Authentication Setup

Confidence tries to avoid storing credentials for the connector destinations whenever possible. Instead, every Confidence account gets a unique GCP service account that’s used to authenticate when writing to a destination. The procedure to configure the authentication differs between GCP and AWS. The next sections describe the authentication steps.

Create a service account with the required permissions
On the Permissions tab for the service account you just created in the GCP console, grant access to the principal account-<your-account-id>@spotify-confidence.iam.gserviceaccount.com to impersonate the account by adding the “Workload Identify User” role to it.

For AWS Confidence uses AssumeRoleWithWebIdentity to securely authenticate without having to store any credentials.

Create a role with the required permissions in the AWS IAM Console. Specify the required permissions for each connector destination type.

Edit the trust relationship for the role, and allow the GCP Service Account to assume the role by using a definition that looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "accounts.google.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:sub": "<GCP Service account ID>"
        }
      }
    }
  ]
}

Documentation Index

​Authentication Setup

Authentication Setup