We chose to use Logstash to perform the migration but there are many other ways of doing it, like remote reindex.
However, remote reindex currently supports only sources over HTTPS with a trusted certificate, which will not be the case if you are using your own private CA to secure your self-managed cluster.
To get more information on the steps required for remote reindex, you can look at the documentation.
Instead of Amazon Cognito, you can also use SAML authentication for Kibana.