Cloudfront Client signing put urls

[Malfunction13]

Hi peeps,
I am trying to create signed GET urls for cloudfront to stream videos on-demand from s3 bucket.
I get the following error:
key_pair_id is required

The problem is i read in the aws docs themselves and on numerous guides on the internet that storing these keys in env variables is bad security practice. Instead the authentication credentials should be fetched from the ec2 instance.

Am I misunderstanding something? Is there some way to make this work without storing any private keys manually?