def create_table(bucketname):
    """ Returns query for behold table in Athena. """
    query_string = f"""CREATE EXTERNAL TABLE behold (
            eventversion STRING,
            useridentity STRUCT<
                        type:STRING,
                        principalid:STRING,
                        arn:STRING,
                        accountid:STRING,
                        invokedby:STRING,
                        accesskeyid:STRING,
                        userName:STRING,
            sessioncontext:STRUCT<
            attributes:STRUCT<
                        mfaauthenticated:STRING,
                        creationdate:STRING>,
            sessionissuer:STRUCT<
                        type:STRING,
                        principalId:STRING,
                        arn:STRING,
                        accountId:STRING,
                        userName:STRING>>>,
            eventtime STRING,
            eventsource STRING,
            eventname STRING,
            awsregion STRING,
            sourceipaddress STRING,
            useragent STRING,
            errorcode STRING,
            errormessage STRING,
            requestparameters STRING,
            responseelements STRING,
            additionaleventdata STRING,
            requestid STRING,
            eventid STRING,
            resources ARRAY<STRUCT<
                        ARN:STRING,
                        accountId:STRING,
                        type:STRING>>,
            eventtype STRING,
            apiversion STRING,
            readonly STRING,
            recipientaccountid STRING,
            serviceeventdetails STRING,
            sharedeventid STRING,
            vpcendpointid STRING
            )
            PARTITIONED BY (account string, region string, year string, month string)
            ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
            STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
            OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
            LOCATION 's3://{bucketname}/AWSLogs/';
            """
    return query_string, 'setup/create_table'
