AWS CloudFront偶发502无法连接源站错误排查求助（CDK部署）

我搭建的AWS架构包含以下组件：

• 绑定的自定义域名
• CloudFront分发
• 作为源站的API Gateway
• 若干Lambda函数，用于渲染由next-aws-lambda-webpack-plugin生成的NextJS路由

整套资源使用CDK进行编排部署，我已经剔除了所有无关逻辑，最小可复现代码如下：

import { Stack, StackProps } from "aws-cdk-lib";
import * as cdk from "aws-cdk-lib";
import { Cors, LambdaIntegration, RestApi } from "aws-cdk-lib/aws-apigateway";
import { Code, LayerVersion, Runtime, Function } from "aws-cdk-lib/aws-lambda";
import { DnsValidatedCertificate } from "aws-cdk-lib/lib/aws-certificatemanager";
import { Distribution, ViewerProtocolPolicy } from "aws-cdk-lib/lib/aws-cloudfront";
import { ARecord, PublicHostedZone, RecordTarget } from "aws-cdk-lib/lib/aws-route53";
import { CloudFrontTarget } from "aws-cdk-lib/lib/aws-route53-targets";
import { Construct } from "constructs";
import { HttpOrigin } from "aws-cdk-lib/lib/aws-cloudfront-origins";

interface Props {
  path1: string;
  path2: string;
  layerPath: string;
}

export class AppStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps & Props) {
    super(scope, id, props);

    const awsNextLayer = new LayerVersion(this, "aws-next-layer", {
      code: Code.fromAsset(props.layerPath),
    });

    const functionOne = new Function(this, `function-one`, {
      functionName: 'function-one',
      runtime: Runtime.NODEJS_14_X,
      handler: "page/handler.render",
      code: Code.fromAsset(props.path1),
      layers: [awsNextLayer],
    });

    const functionTwo = new Function(this, `function-one`, {
      functionName: 'function-one',
      runtime: Runtime.NODEJS_14_X,
      handler: "page/handler.render",
      code: Code.fromAsset(props.path1),
      layers: [awsNextLayer],
    });

    const api = new RestApi(this, "pages-api", {
      defaultCorsPreflightOptions: {
        allowOrigins: Cors.ALL_ORIGINS,
      },
      restApiName: `api`,
    });

    api.root.addResource('function-one').addMethod("GET", new LambdaIntegration(functionOne));
    api.root.addResource('function-two').addMethod("GET", new LambdaIntegration(functionTwo));

    const domainName = `dev.app.my-domain-name.com`

    const hostedZone = new PublicHostedZone(this, "HostedZone", {
      zoneName: domainName,
    });

    const certificate = new DnsValidatedCertificate(this, "cert", {
      domainName,
      hostedZone,
      region: "us-east-1",
    });

    const apiGatewayDomainName = `${api.restApiId}.execute-api.${cdk.Aws.REGION}.amazonaws.com`;

    const origin = new HttpOrigin(apiGatewayDomainName, { originPath: "/prod" });

    const distribution = new Distribution(this, "cdn", {
      domainNames: [domainName],
      defaultBehavior: {
        origin,
        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
      },
      certificate,
    });

    new ARecord(this, "a-record", {
      zone: hostedZone,
      recordName: domainName,
      target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),
    });
  }

}

当前遇到的问题：架构大部分时间运行正常，但会无规律出现CloudFront wasn't able to connect to the origin报错，我已经查阅了AWS官方相关文档，但不清楚如何定位具体故障原因，以下是可行的排查方向：

• 先修复CDK代码的明显错误：第二个Lambda函数functionTwo的构造ID、函数名均和第一个函数functionOne完全重复，部署时会出现资源冲突，导致访问function-two路径时API Gateway找不到对应后端服务，直接返回错误触发CloudFront告警。需要将functionTwo的构造ID改为function-two，函数名改为function-two，保证资源唯一。
• 检查Lambda运行配置：当前Lambda未显式配置超时时间，默认仅为3秒，NextJS页面渲染很容易超过该阈值导致超时，API Gateway返回504错误触发CloudFront报错。建议将Lambda超时时间调整为10~30秒，内存配置不低于256MB，避免冷启动、渲染耗时过长导致的超时。
• 查看API Gateway的CloudWatch指标：重点核对报错时间点是否有5xx、429错误返回，排除API Gateway限流、集成调用失败的问题。默认API Gateway单接口限流为每秒500请求，流量突增时会触发限流返回429，也会被CloudFront判定为源站不可用。
• 调整CloudFront源站配置：可以适当调高源站连接超时、响应超时阈值，同时开启5xx错误的源站重试策略，降低偶发网络抖动导致的报错概率。

内容的提问来源于stack exchange，提问作者Ben Wainwright