def get_role_arn(user_arn, role, account_id=None):
    """
    Creates a role ARN string based on a role name and, optionally, an
    account ID.

    If role is None or empty, '' will be returned. This value will indicate to
    the mfa method that no role should be assumed.

    Arguments:
        user_arn: Arn returned from a call to iam_client.get_user()
        role: the role name
        account_id: AWS account ID

    Returns:
        The ARN as a string.
    """
    if not role:
        return ''

    if account_id:
        base_arn = user_arn.rsplit(':', 2)[0]
        return '{0}:{1}:role/{2}'.format(
            base_arn,
            account_id,
            role
        )
    else:
        base_arn = user_arn.rsplit(':', 1)[0]
        return '{0}:role/{1}'.format(base_arn, role)