def active_users(account, days_back):
    """ Returns query for finding active users (since days_back value)."""
    query_string = f"""SELECT DISTINCT useridentity.arn
        FROM behold
        WHERE account = '{account}'
        AND useridentity.type = 'IAMUser'
        AND useridentity.arn IS NOT NULL
        AND from_iso8601_timestamp(eventtime) > date_add('day', -{days_back}, now());"""
    return (query_string, f"athena_results/active_users/{account}")