def services_by_role(account, days_back, role_arn, role_name):
    """ Returns query for eventsource (service) / actions performed by role. """
    query_string = f"""SELECT DISTINCT eventsource, eventname FROM behold
        WHERE account = '{account}'
        AND (useridentity.sessioncontext.sessionissuer.arn = '{role_arn}')
        AND from_iso8601_timestamp(eventtime) > date_add('day', -{days_back}, now())
        ORDER BY eventsource, eventname;"""
    return (query_string,
        f'athena_results/services_by_role/{account}/{role_name}')
