guardduty runtime monitoring should be enabled