'Make sure the SG does not contain large networks.'

def check_securitygroup_large_subnet(self, sg_item):

    tag = 'Security    Group    network    larger    than    /24'
    severity = 3
    multiplier = _check_empty_security_group(sg_item)
    for rule in sg_item.config.get('rules', []):
        cidr = rule.get('cidr_ip', None)
        if (cidr and (not self._check_inclusion_in_network_whitelist(cidr))):
            if (('/' in cidr) and (not (cidr == '0.0.0.0/0')) and (not (cidr == '10.0.0.0/8')) and (not (cidr == '::/0'))):
                mask = int(cidr.split('/')[1])
                if ((mask < 24) and (mask > 0)):
                    notes = '{}    on    {}'.format(cidr, self._port_for_rule(rule))
                    self.add_issue((severity * multiplier), tag, sg_item, notes=notes)
