What is Sid attribute use for in key policies?

Question

Here is a documentation:

Sid – (Optional) The Sid is a statement identifier, an arbitrary string you can use to identify the statement.

Does it means that Sid parameter is just description?

Answer 1

In another part of the documentation AWS provides some additional information about the purpose of the Sid:

The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign a Sid value to each statement in a statement array. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In IAM, the Sid value must be unique within a JSON policy.

So yes, it's just a description.

Answer 2

You can use Sid to refer to a specific statement in a long policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAll",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "DenyList",
            "Effect": "Deny",
            "Action": "s3:List*",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

For example when explain the policy, you can say that the AllowAll statement allows all S3 actions, but that DenyList denies all list actions. Imagine if those Sids weren't there, how would you refer to either of them?

This might be semantic nitpicking, but I disagree that it's "just a description", because descriptions don't have to be unique. Also Sid doesn't support spaces so it's really just an ID.

Update: Quoting AWS docs

Some AWS services (for example, Amazon SQS or Amazon SNS) might require this element and have uniqueness requirements for it.

Answer 3

I don't think 'just a description' is enough to describe the meaning of Sid.

I think a better question would be: 'how can I use Sid to my advantage?'

Here is one example:

• you could use Sid to process your policies in case you ever need to find the needle in the hay stack.

Example: you have 1k policies and would like to find the policy that does "S3DenyPublicReadACL". maybe you store that policy in an s3 bucket, so you can reuse it.

Solution: Write a script/lambda, find it and reuse it in an automatic way.