> ## Documentation Index
> Fetch the complete documentation index at: https://confidence-auth-testing.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Export Data From Confidence

> Learn how to export data from Confidence using connectors.

**Export Data From Confidence**

Learn how to export data from Confidence using connectors.

To export data Confidence has the concept of *"Connectors."* A connector takes events generated inside the Confidence platform (for example events specifying who got assigned to what experience) and forwards them to a destination.

Configure connectors in the **Admin** panel in [Confidence](https://app.confidence.spotify.com).

Three types of connectors are available. Each connector forwards different kinds of data:

* **Flag Applied Connectors** - These connectors export the assignment data.
* **Event Connectors** - These connectors export event data ingested through the Confidence event sender SDKs.
* **Platform Connectors** - These connectors forwards internal events to the customer's system. The events could for example be `MetricCalculationCompleted` or `WorkflowInstanceCreated`.

The connector destination can be either a warehouse such as BigQuery or Databricks, or a Pub/Sub topic or a Kinesis Stream that exists in your environment. When the data is in your warehouse, Confidence can query it by defining assignment and fact tables on top of the data.

## Authentication Setup

Confidence tries to avoid storing credentials for the connector destinations whenever possible. Instead, every Confidence account gets a unique GCP service account that's used to authenticate when writing to a destination. The procedure to configure the authentication differs between GCP and AWS. The next sections describe the authentication steps.

**GCP**

* Create a service account with the required permissions
* On the Permissions tab for the service account you just created in the GCP console, grant access to the principal `account-<your-account-id>@spotify-confidence.iam.gserviceaccount.com` to impersonate the account by adding the "Workload Identify User" role to it.

**AWS**

For AWS Confidence uses [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) to securely authenticate without having to store any credentials.

* Create a role with the required permissions in the AWS IAM Console. Specify the required permissions for each connector destination type.
* Edit the trust relationship for the role, and allow the GCP Service Account to assume the role by using a definition that looks like this:

  ```json theme={null}
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "accounts.google.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "accounts.google.com:sub": "<GCP Service account ID>"
          }
        }
      }
    ]
  }
  ```