Why is Lambda@Edge still being invoked on every request despite CloudFront caching?

The behavior you're experiencing is actually expected and by design for Origin Response Lambda@Edge functions. Even when CloudFront serves a cached response, the Origin Response trigger still executes for every request. This is because the Origin Response function is designed to run after CloudFront receives a response from the origin, but before it caches the object.

For your use case, where you want to modify index.html and then cache the result without invoking Lambda@Edge on subsequent requests, you should consider using a Viewer Request or Viewer Response trigger instead of an Origin Response trigger.

Here's why:

1. Viewer Request functions execute when CloudFront receives a request from a viewer, before it checks the cache. If you modify the request here, you can potentially avoid unnecessary origin requests.

2. Viewer Response functions execute before returning the file to the viewer, regardless of whether it came from the cache or the origin. This would allow you to modify the response while still benefiting from caching.

By moving your logic to one of these triggers, you can achieve your goal of reducing Lambda@Edge executions while still modifying index.html as needed.

To implement this:

1. Move your index.html modification logic to a Viewer Response function.
2. Ensure your cache policy is correctly set up to cache the modified response.
3. Set appropriate Cache-Control headers in your Lambda function or from your origin to control how long CloudFront should cache the modified index.html.

Remember, when using Viewer Response triggers, you'll need to handle both cached and uncached scenarios in your function, as it will run for all responses. However, this approach will allow you to benefit from caching while still having the ability to modify the response when necessary.
Sources
CloudFront events that can trigger a Lambda@Edge function - Amazon CloudFront

CloudFront should not invoke your Lambda@Edge when it is configured for Origin Request or Origin Response and the content is cashed.

If CF invokes your function either the content is not cached, or you actually have an Origin Request or Origin Response triggers. If this is not the case, I suggest that you create a support case.