Thank you for the info. And I'm sorry I was not able to update here also. So the resolution that worked for us was a compound one:
- we upgraded to JHA take 169, as instructed by TAC
- on AWS side we deleted the vpn connection (formerly created in format of vgw-xxx 8 chars long) and created a new one with the exact same settings. This fell into the new 17 characters naming convention which apparently also runs on newer software
This created a stable environment. Also for others reading, make sure you use VTIs with AWS and directional match instead of just the community name in the VPN column in the rulebase.
Side note: After just upgrading to JHA 169 without rebuilding on AWS side, we were seeing two IPSEC SAs created for a permanent tunnel, with one tunnel per gateway pair, which would cause traffic to not flow correctly.
Hope this helps anyone else to fix this issue.