diff --git a/c7n/resources/asg.py b/c7n/resources/asg.py
index <HASH>..<HASH> 100644
--- a/c7n/resources/asg.py
+++ b/c7n/resources/asg.py
@@ -846,7 +846,8 @@ class Resume(BaseAction):
         """
         session = local_session(self.manager.session_factory)
         asg_client = session.client('autoscaling')
-        asg_client.resume_processes(
+        self.manager.retry(
+            asg_client.resume_processes,
             AutoScalingGroupName=asg['AutoScalingGroupName'])
 
 
diff --git a/c7n/resources/s3.py b/c7n/resources/s3.py
index <HASH>..<HASH> 100644
--- a/c7n/resources/s3.py
+++ b/c7n/resources/s3.py
@@ -450,9 +450,8 @@ class EncryptionRequiredPolicy(BucketActionBase):
                     "s3:x-amz-server-side-encryption": ["AES256", "aws:kms"]}}}
 
         statements = p.get('Statement', [])
-        found = False
         for s in list(statements):
-            if s['Sid'] == encryption_sid:
+            if s.get('Sid', '') == encryption_sid:
                 log.debug("Bucket:%s Found extant encrypt policy", b['Name'])
                 if s != encryption_statement:
                     log.info(
retry on asg suspend/resume and handle no s3 sid in statement (#<I>)