'alert when an ELB has an "internet-facing" scheme.'

def check_internet_scheme(self, elb_item):

    scheme = elb_item.config.get('Scheme', None)
    vpc = elb_item.config.get('VPCId', None)
    if (scheme and (scheme == u'internet-facing') and (not vpc)):
        self.add_issue(1, 'ELB    is    Internet    accessible.', elb_item)
    elif (scheme and (scheme == u'internet-facing') and vpc):
        security_groups = elb_item.config.get('SecurityGroups', [])
        sg_items = self.get_watcher_support_items(SecurityGroup.index, elb_item.account)
        for sgid in security_groups:
            for sg in sg_items:
                if (sg.config.get('id') == sgid):
                    sg_cidrs = set()
                    internet_accessible_cidrs = set()
                    for rule in sg.config.get('rules', []):
                        cidr = rule.get('cidr_ip', '')
                        if ((rule.get('rule_type', None) == 'ingress') and cidr):
                            if cidr.endswith('/0'):
                                internet_accessible_cidrs.add(cidr)
                            elif ((not check_rfc_1918(cidr)) and (not self._check_inclusion_in_network_whitelist(cidr))):
                                sg_cidrs.add(cidr)
                    if sg_cidrs:
                        notes = 'SG    [{sgname}]    via    [{cidr}]'.format(sgname=sg.name, cidr=',    '.join(sg_cidrs))
                        self.add_issue(1, 'VPC    ELB    accessible    from    non-private    CIDR.', elb_item, notes=notes)
                    if internet_accessible_cidrs:
                        notes = 'SG    [{sgname}]    via    [{cidr}]'.format(sgname=sg.name, cidr=',    '.join(internet_accessible_cidrs))
                        self.add_issue(1, 'VPC    ELB    is    Internet    accessible.', elb_item, notes=notes)
                    break
