A Security Association (SA) is a one-way agreement between IPsec peers. It defines the encryption algorithm, keys, and other parameters for one direction of traffic.
Since SAs are unidirectional, you need SAs for bidirectional communication. Each SA has a unique SPI (Security Parameter Index) that identifies it. When a peer receives an ESP packet, it looks up the SPI to find the correct SA and decryption keys.