App Service web apps should have HTTP logs enabled
Checkov CKV_AZURE_63 is titled "Ensure that App service enables HTTP logging". This check covers App Service web apps, so the scope of the validation is the web apps in Azure App Service and whether HTTP logging is enabled for them.
This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised.
What this control checks
Web app HTTP logs must be enabled; disabled HTTP logs is non-compliant.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls azure_compliance.control.appservice_web_app_diagnostic_logs_enabled and azure_compliance.control.appservice_web_app_http_logs_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_63.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_http_logs_enabled - Checkov Check:
CKV_AZURE_63 - Powerpipe Controls:
azure_compliance.control.appservice_web_app_diagnostic_logs_enabled,azure_compliance.control.appservice_web_app_http_logs_enabled
Last reviewed: 2026-10-11