def active_roles(account, days_back):
    """ Returns query for finding active roles (since days_back value). """
    query_string = f"""SELECT DISTINCT useridentity.sessioncontext.sessionissuer.arn
        FROM behold
        WHERE account = '{account}'
        AND useridentity.type = 'AssumedRole'
        AND from_iso8601_timestamp(eventtime) > date_add('day', -{days_back}, now());"""
    return query_string, f'athena_results/active_roles/{account}'
