The IPsec SAs are formed as a result of the access-list that is referenced in the cryptomap for a given site-site VPN.
For that reason, I try to use access-lists with human readable names so I can easily have a look at the ACL to know which subnets (or, more accurately, local-remote subnet pairs) are covered in a given site-site VPN.
As you noted, the :show crypto ipsec sa" command is the most definitive, although it often gives you more information than you want. I sometimes use that and trim the output by piping it to an "include" statement.