diff --git a/c7n/resources/cloudfront.py b/c7n/resources/cloudfront.py
index 7d9979bf4..ee7805d23 100644
--- a/c7n/resources/cloudfront.py
+++ b/c7n/resources/cloudfront.py
@@ -661,6 +661,10 @@ class DistributionUpdateAction(BaseUpdateAction):
             raise e
 
 
+StreamingDistribution.filter_registry.register('shield-enabled', IsShieldProtected)
+StreamingDistribution.action_registry.register('set-shield', SetShieldProtection)
+
+
 @StreamingDistribution.action_registry.register('set-attributes')
 class StreamingDistributionUpdateAction(BaseUpdateAction):
     """Action to update the attributes of a distribution
diff --git a/c7n/resources/elasticsearch.py b/c7n/resources/elasticsearch.py
index 76a50680f..1b86fe535 100644
--- a/c7n/resources/elasticsearch.py
+++ b/c7n/resources/elasticsearch.py
@@ -27,9 +27,8 @@ from .securityhub import PostFinding
 class DescribeDomain(DescribeSource):
 
     def get_resources(self, resource_ids):
-        client = local_session(self.manager.session_factory).client('es')
-        return client.describe_elasticsearch_domains(
-            DomainNames=resource_ids)['DomainStatusList']
+        # augment will turn these into resource dictionaries
+        return resource_ids
 
     def augment(self, domains):
         client = local_session(self.manager.session_factory).client('es')

Elasticsearch policy sending DomainName as Dict, expect STR
**Describe the bug**
Lambdas created using the Elasticsearch policy are passing the DomainName to the AWS API as a dictionary, and the API needs it to be a string. You can find a gist of the full error here:  https://gist.github.com/theotherothermatt/199f78ee33c0044dd2365583c9c3f604

Rolled back to version 0.9.1 and problem does not exist. There were commits to elasticsearch.py in both 0.9.2 and 0.9.3, so I think that the problem resides somewhere in those bug fixes.
 
**To Reproduce**
With c7n==0.9.3, use policy:
```yaml
    mode:
        type: cloudtrail
        role: arn:aws:iam::<$account-id>:role/the-correct-role
        events:
         - source: es.amazonaws.com
           event: CreateElasticsearchDomain
           ids: "requestParameters.domainName"
    filters:
      - type: value
        key: "EncryptionAtRestOptions.Enabled"
        value: false
    actions:
        - type: delete
```
Then create an ES domain that is not encrypted at rest. Error will be in log stream.

Roll back to c7n==0.9.1
Try the above policy again (on a new lambda of course)
Domain will be deleted with no error

**Expected behavior**
The ES Domain will be deleted

**Background (please complete the following information):**
 - OS: OSx 10.15.5
 - Python Version: python 3.7.7
 - Custodian Version: 0.9.3
 - Cloud Provider: AWS
 - Policy: [please exclude any account/sensitive information]
```yaml
    mode:
        type: cloudtrail
        role: arn:aws:iam::<$account-id>:role/the-correct-role
        events:
         - source: es.amazonaws.com
           event: CreateElasticsearchDomain
           ids: "requestParameters.domainName"
    filters:
      - type: value
        key: "EncryptionAtRestOptions.Enabled"
        value: false
    actions:
        - type: delete
```
 - `custodian version --debug` output
Custodian:   0.9.3
Python:      3.7.7 (default, Mar 10 2020, 15:43:03)
             [Clang 11.0.0 (clang-1100.0.33.17)]
Platform:    posix.uname_result(sysname='Darwin', nodename='', release='19.5.0', version='Darwin Kernel Version 19.5.0: Tue May 26 20:41:44 PDT 2020; root:xnu-6153.121.2~2/RELEASE_X86_64', machine='x86_64')
Using venv:  False
Docker: False
Installed:

argcomplete==1.11.1
attrs==19.3.0
boto3==1.13.24
botocore==1.16.24
docutils==0.15.2
importlib-metadata==1.6.1
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==0.16.0
python-dateutil==2.8.1
pyyaml==5.3.1
s3transfer==0.3.3
setuptools==46.0.0
six==1.15.0
tabulate==0.8.7
urllib3==1.25.9
zipp==3.1.0

diff --git a/tests/data/placebo/test_elasticsearch_get/es.DescribeElasticsearchDomains_1.json b/tests/data/placebo/test_elasticsearch_get/es.DescribeElasticsearchDomains_1.json
new file mode 100644
index 000000000..5328ce923
--- /dev/null
+++ b/tests/data/placebo/test_elasticsearch_get/es.DescribeElasticsearchDomains_1.json
@@ -0,0 +1,73 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "DomainStatusList": [
+            {
+                "DomainId": "644160558196/devx",
+                "DomainName": "devx",
+                "ARN": "arn:aws:es:us-east-1:644160558196:domain/devx",
+                "Created": true,
+                "Deleted": false,
+                "Endpoint": "search-devx-ndp75qp7n4kaeh6fzvgngtputa.us-east-1.es.amazonaws.com",
+                "Processing": false,
+                "UpgradeProcessing": false,
+                "ElasticsearchVersion": "7.4",
+                "ElasticsearchClusterConfig": {
+                    "InstanceType": "r5.large.elasticsearch",
+                    "InstanceCount": 1,
+                    "DedicatedMasterEnabled": false,
+                    "ZoneAwarenessEnabled": false,
+                    "WarmEnabled": false
+                },
+                "EBSOptions": {
+                    "EBSEnabled": true,
+                    "VolumeType": "gp2",
+                    "VolumeSize": 10
+                },
+                "AccessPolicies": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"es:*\",\"Resource\":\"arn:aws:es:us-east-1:644160558196:domain/devx/*\"}]}",
+                "SnapshotOptions": {},
+                "CognitoOptions": {
+                    "Enabled": false
+                },
+                "EncryptionAtRestOptions": {
+                    "Enabled": true,
+                    "KmsKeyId": "arn:aws:kms:us-east-1:644160558196:key/6917a312-adce-4bbc-8202-958f2db490fa"
+                },
+                "NodeToNodeEncryptionOptions": {
+                    "Enabled": true
+                },
+                "AdvancedOptions": {
+                    "rest.action.multi.allow_explicit_index": "true"
+                },
+                "ServiceSoftwareOptions": {
+                    "CurrentVersion": "R20200522-p1",
+                    "NewVersion": "",
+                    "UpdateAvailable": false,
+                    "Cancellable": false,
+                    "UpdateStatus": "COMPLETED",
+                    "Description": "There is no software update available for this domain.",
+                    "AutomatedUpdateDate": {
+                        "__class__": "datetime",
+                        "year": 1969,
+                        "month": 12,
+                        "day": 31,
+                        "hour": 19,
+                        "minute": 0,
+                        "second": 0,
+                        "microsecond": 0
+                    },
+                    "OptionalDeployment": true
+                },
+                "DomainEndpointOptions": {
+                    "EnforceHTTPS": true,
+                    "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"
+                },
+                "AdvancedSecurityOptions": {
+                    "Enabled": true,
+                    "InternalUserDatabaseEnabled": false
+                }
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_elasticsearch_get/es.ListTags_1.json b/tests/data/placebo/test_elasticsearch_get/es.ListTags_1.json
new file mode 100644
index 000000000..db3be6e3f
--- /dev/null
+++ b/tests/data/placebo/test_elasticsearch_get/es.ListTags_1.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "TagList": []
+    }
+}
\ No newline at end of file
diff --git a/tests/test_elasticsearch.py b/tests/test_elasticsearch.py
index 4d0471dd9..585469788 100644
--- a/tests/test_elasticsearch.py
+++ b/tests/test_elasticsearch.py
@@ -18,6 +18,17 @@ from c7n.resources.aws import shape_validate
 
 class ElasticSearch(BaseTest):
 
+    def test_get_resources(self):
+        factory = self.replay_flight_data('test_elasticsearch_get')
+        p = self.load_policy({
+            'name': 'es-get',
+            'resource': 'aws.elasticsearch'},
+            session_factory=factory)
+        resources = p.resource_manager.get_resources(['devx'])
+        self.assertEqual(len(resources), 1)
+        self.assertEqual(
+            resources[0]['DomainName'], 'devx')
+
     def test_resource_manager(self):
         factory = self.replay_flight_data("test_elasticsearch_query")
         p = self.load_policy(

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio
apt-get update apt-get install -y gcc
3.8
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
apipkg==1.5
appdirs==1.4.4
argcomplete==1.11.1
attrs==19.3.0
aws-xray-sdk==2.6.0
bleach==3.1.5
boto3==1.14.8
botocore==1.17.8
-e git+https://github.com/cloud-custodian/cloud-custodian.git@af521ac1dcfbcc31d7b1ad79160b612dd776223d#egg=c7n
certifi==2020.6.20
cffi==1.14.0
chardet==3.0.4
coverage==5.1
cryptography==2.9.2
distlib==0.3.0
docutils==0.15.2
exceptiongroup==1.2.2
execnet==1.7.1
filelock==3.0.12
flake8==3.8.3
future==0.18.2
idna==2.9
importlib-metadata==1.6.1
iniconfig==2.1.0
jeepney==0.4.3
jmespath==0.10.0
jsonpatch==1.26
jsonpickle==1.4.1
jsonpointer==2.0
jsonschema==3.2.0
keyring==21.2.1
mccabe==0.6.1
mock==4.0.2
more-itertools==8.4.0
multidict==4.7.6
packaging==20.4
pkginfo==1.5.0.1
placebo==0.9.0
pluggy==1.5.0
psutil==5.7.0
py==1.8.2
pycodestyle==2.6.0
pycparser==2.20
pyflakes==2.2.0
Pygments==2.6.1
pyparsing==2.4.7
pyrsistent==0.16.0
pytest==8.3.5
pytest-asyncio==0.24.0
pytest-cov==2.10.0
pytest-forked==1.1.3
pytest-mock==3.14.0
pytest-sugar==0.9.3
pytest-xdist==1.32.0
python-dateutil==2.8.1
PyYAML==5.3.1
readme-renderer==26.0
requests==2.24.0
requests-toolbelt==0.9.1
s3transfer==0.3.3
SecretStorage==3.1.2
six==1.15.0
tabulate==0.8.7
termcolor==1.1.0
toml==0.10.1
tomli==2.2.1
tox==3.15.2
tqdm==4.46.1
twine==3.1.1
urllib3==1.25.9
vcrpy==4.0.2
virtualenv==20.0.24
wcwidth==0.2.4
webencodings==0.5.1
wrapt==1.12.1
yarl==1.4.2
zipp==3.1.0

name: cloud-custodian
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=24.2=py38h06a4308_0
  - python=3.8.20=he870216_0
  - readline=8.2=h5eee18b_0
  - setuptools=75.1.0=py38h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.44.0=py38h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - apipkg==1.5
      - appdirs==1.4.4
      - argcomplete==1.11.1
      - attrs==19.3.0
      - aws-xray-sdk==2.6.0
      - bleach==3.1.5
      - boto3==1.14.8
      - botocore==1.17.8
      - c7n==0.9.4
      - certifi==2020.6.20
      - cffi==1.14.0
      - chardet==3.0.4
      - coverage==5.1
      - cryptography==2.9.2
      - distlib==0.3.0
      - docutils==0.15.2
      - exceptiongroup==1.2.2
      - execnet==1.7.1
      - filelock==3.0.12
      - flake8==3.8.3
      - future==0.18.2
      - idna==2.9
      - importlib-metadata==1.6.1
      - iniconfig==2.1.0
      - jeepney==0.4.3
      - jmespath==0.10.0
      - jsonpatch==1.26
      - jsonpickle==1.4.1
      - jsonpointer==2.0
      - jsonschema==3.2.0
      - keyring==21.2.1
      - mccabe==0.6.1
      - mock==4.0.2
      - more-itertools==8.4.0
      - multidict==4.7.6
      - packaging==20.4
      - pkginfo==1.5.0.1
      - placebo==0.9.0
      - pluggy==1.5.0
      - psutil==5.7.0
      - py==1.8.2
      - pycodestyle==2.6.0
      - pycparser==2.20
      - pyflakes==2.2.0
      - pygments==2.6.1
      - pyparsing==2.4.7
      - pyrsistent==0.16.0
      - pytest==8.3.5
      - pytest-asyncio==0.24.0
      - pytest-cov==2.10.0
      - pytest-forked==1.1.3
      - pytest-mock==3.14.0
      - pytest-sugar==0.9.3
      - pytest-xdist==1.32.0
      - python-dateutil==2.8.1
      - pyyaml==5.3.1
      - readme-renderer==26.0
      - requests==2.24.0
      - requests-toolbelt==0.9.1
      - s3transfer==0.3.3
      - secretstorage==3.1.2
      - six==1.15.0
      - tabulate==0.8.7
      - termcolor==1.1.0
      - toml==0.10.1
      - tomli==2.2.1
      - tox==3.15.2
      - tqdm==4.46.1
      - twine==3.1.1
      - urllib3==1.25.9
      - vcrpy==4.0.2
      - virtualenv==20.0.24
      - wcwidth==0.2.4
      - webencodings==0.5.1
      - wrapt==1.12.1
      - yarl==1.4.2
      - zipp==3.1.0
prefix: /opt/conda/envs/cloud-custodian

tests/test_elasticsearch.py::ElasticSearch::test_get_resources
tests/test_elasticsearch.py::ElasticSearch::test_delete_search tests/test_elasticsearch.py::ElasticSearch::test_domain_add_tag tests/test_elasticsearch.py::ElasticSearch::test_domain_mark_for_op tests/test_elasticsearch.py::ElasticSearch::test_domain_marked_for_op tests/test_elasticsearch.py::ElasticSearch::test_domain_remove_tag tests/test_elasticsearch.py::ElasticSearch::test_metrics_domain tests/test_elasticsearch.py::ElasticSearch::test_modify_security_groups tests/test_elasticsearch.py::ElasticSearch::test_post_finding_es tests/test_elasticsearch.py::ElasticSearch::test_resource_manager
c7n/resources/cloudfront.py c7n/resources/elasticsearch.py
c7n/resources/cloudfront.py c7n/resources/elasticsearch.py