Sign-in to AWS Console with your root account
Go to "My Security Credentials"
In CloudFront key pairs section, click on Create New Key Pair button.
Click on "Download Private Key File" and you should receive a file having the format key-XYZ.pem
Fill in your CloudFront key pairs in the CloudFront Configuration with XYZ is Access Key ID and the downloaded file contents is RSA KEY.