1. Prepare an .aws-secrets file to store your AWS access identifiers and get the cfcurl.pl script (tutorial).
2. Define a Distribution. Save this snippet in a file called create_request.xml:
   <?xml version="1.0" encoding="UTF-8"?>
<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2008-06-30/">
..<Origin>YourBucketNameHere.s3.amazonaws.com</Origin>
..<CallerReference>20080930090000</CallerReference>
..<CNAME>cdn.example.com</CNAME>
..<Enabled>true</Enabled>
</DistributionConfig>
3. Run the following command:
   ./cfcurl.pl --keyname <key name from .aws-secrets file> -- -X POST -i -H "Content-Type:text/xml; charset=UTF-8" --upload-file create_request.xml https://cloudfront.amazonaws.com/2008-06-30/distribution
4. Save the response (especially the E-Tag) for later, you may need it to update the configuration.
5. Create a CNAME entry in your DNS server using the DomainName in the response.
6. Done!

I’m trying to think about an elegant way to manage versioning from now on (in PHP). I used to add a query-string version parameter to each resource to deal with client-side caching. With CloudFront, I need actual filenames to change, since Amazon’s servers ignore the query-string parameters when fetching the file from the S3 origin. Any ideas would be greatly appreciated!

Update: see comment below.