A cloud migration is rarely an infrastructure problem. It is a sequencing problem with a network topology attached. Move the wrong thing first and you spend the rest of the project working around a decision you cannot undo without starting over.
Long-lived cloud credentials in CI are the most reliably exploited secret in any organisation. They are copied into a settings page once, they never expire, and nothing tells you when one leaks. Federated identity — OIDC — removes them: the pipeline presents a short-lived token that the cloud verifies against your CI provider, and no static key exists to steal.
The migration is genuinely worth doing. It also fails, almost always, at exactly one step.
A cluster that costs three times what it should is rarely running three times the workload. It is usually running the right workload, badly sized, on the wrong pricing model, with a layer of things nobody is willing to delete.