prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CloudFormation: S3 default encryption check should look for ServerSideEncryptionByDefault
  The CloudFormation check for CKV_AWS_19 only looks for `ServerSideEncryptionRule`, not `ServerSideEncryptionByDefault`:
  
  https://github.com/bridgecrewio/checkov/blob/864d12ad0dfc6ca898dbacf7dc16fdc20f702733/checkov/cloudformation/checks/resource/aws/S3Encryption.py
  
  The syntax used in the S3 template does not appear to be used anywhere else in GitHub:
  
  https://github.com/bridgecrewio/checkov/blob/864d12ad0dfc6ca898dbacf7dc16fdc20f702733/tests/cloudformation/checks/resource/aws/S3Templates/ExampleS3.yaml#L13 
  
  All of the working CloudFormation templates which I've seen look like this:
  
  https://github.com/cloudconformity/documentation-api/blob/cba56c057d42c19db606f7d72ca197ee52d97848/examples/cloudformation-snippets/S3Bucket.yml#L8-L11
  
  Checkov version: 1.0.312
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/cloudformation/checks/resource/aws/S3Encryption.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckResult, CheckCategories
  2 from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class S3Encryption(BaseResourceCheck):
  6     def __init__(self):
  7         name = "Ensure the S3 bucket has server-side-encryption enabled"
  8         id = "CKV_AWS_19"
  9         supported_resources = ['AWS::S3::Bucket']
  10         categories = [CheckCategories.LOGGING]
  11         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  12 
  13     def scan_resource_conf(self, conf):
  14         if conf.get('Properties') and conf['Properties'].get('ServerSideEncryptionRule'):
  15             return CheckResult.PASSED
  16         return CheckResult.FAILED
  17 
  18 
  19 check = S3Encryption()
  20
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/cloudformation/checks/resource/aws/S3Encryption.py b/checkov/cloudformation/checks/resource/aws/S3Encryption.py
  --- a/checkov/cloudformation/checks/resource/aws/S3Encryption.py
  +++ b/checkov/cloudformation/checks/resource/aws/S3Encryption.py
  @@ -11,8 +11,11 @@
           super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
   
       def scan_resource_conf(self, conf):
  -        if conf.get('Properties') and conf['Properties'].get('ServerSideEncryptionRule'):
  -            return CheckResult.PASSED
  +        if conf.get('Properties'):
  +            if conf['Properties'].get('ServerSideEncryptionRule') or \
  +                (conf['Properties'].get('BucketEncryption') and
  +                 len(conf['Properties']['BucketEncryption'].get('ServerSideEncryptionConfiguration', [])) > 0):
  +                return CheckResult.PASSED
           return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/cloudformation/checks/resource/aws/S3Encryption.py b/checkov/cloudformation/checks/resource/aws/S3Encryption.py\n--- a/checkov/cloudformation/checks/resource/aws/S3Encryption.py\n+++ b/checkov/cloudformation/checks/resource/aws/S3Encryption.py\n@@ -11,8 +11,11 @@\n         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n \n     def scan_resource_conf(self, conf):\n-        if conf.get('Properties') and conf['Properties'].get('ServerSideEncryptionRule'):\n-            return CheckResult.PASSED\n+        if conf.get('Properties'):\n+            if conf['Properties'].get('ServerSideEncryptionRule') or \\\n+                (conf['Properties'].get('BucketEncryption') and\n+                 len(conf['Properties']['BucketEncryption'].get('ServerSideEncryptionConfiguration', [])) > 0):\n+                return CheckResult.PASSED\n         return CheckResult.FAILED\n", "issue": "CloudFormation: S3 default encryption check should look for ServerSideEncryptionByDefault\nThe CloudFormation check for CKV_AWS_19 only looks for `ServerSideEncryptionRule`, not `ServerSideEncryptionByDefault`:\r\n\r\nhttps://github.com/bridgecrewio/checkov/blob/864d12ad0dfc6ca898dbacf7dc16fdc20f702733/checkov/cloudformation/checks/resource/aws/S3Encryption.py\r\n\r\nThe syntax used in the S3 template does not appear to be used anywhere else in GitHub:\r\n\r\nhttps://github.com/bridgecrewio/checkov/blob/864d12ad0dfc6ca898dbacf7dc16fdc20f702733/tests/cloudformation/checks/resource/aws/S3Templates/ExampleS3.yaml#L13 \r\n\r\nAll of the working CloudFormation templates which I've seen look like this:\r\n\r\nhttps://github.com/cloudconformity/documentation-api/blob/cba56c057d42c19db606f7d72ca197ee52d97848/examples/cloudformation-snippets/S3Bucket.yml#L8-L11\r\n\r\nCheckov version: 1.0.312\n", "before_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass S3Encryption(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure the S3 bucket has server-side-encryption enabled\"\n        id = \"CKV_AWS_19\"\n        supported_resources = ['AWS::S3::Bucket']\n        categories = [CheckCategories.LOGGING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if conf.get('Properties') and conf['Properties'].get('ServerSideEncryptionRule'):\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = S3Encryption()\n", "path": "checkov/cloudformation/checks/resource/aws/S3Encryption.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass S3Encryption(BaseResourceCheck):\n    def __init__(self):\n        name = \"Ensure the S3 bucket has server-side-encryption enabled\"\n        id = \"CKV_AWS_19\"\n        supported_resources = ['AWS::S3::Bucket']\n        categories = [CheckCategories.LOGGING]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf):\n        if conf.get('Properties'):\n            if conf['Properties'].get('ServerSideEncryptionRule') or \\\n                (conf['Properties'].get('BucketEncryption') and\n                 len(conf['Properties']['BucketEncryption'].get('ServerSideEncryptionConfiguration', [])) > 0):\n                return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = S3Encryption()\n", "path": "checkov/cloudformation/checks/resource/aws/S3Encryption.py"}]}