A customer managed policy does not keep a link to the file it was made from. Its document lives in IAM as a version: v1 first, then v2 and so on. Exactly one version is the default, and the default is the one IAM uses.

Every user, group and role the policy is attached to gets the change the moment a new default is set.

Read the current document

list-attached-user-policies shows the ARN of each policy attached to a user. With the ARN, read a version:

aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/ReportsRead --version-id v1

The document is under PolicyVersion.Document. To edit it, save just that part to a file:

aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/ReportsRead --version-id v1 --query PolicyVersion.Document > ~/fixed.json

Fix ~/fixed.json in the editor.

Add a version

aws iam create-policy-version --policy-arn arn:aws:iam::123456789012:policy/ReportsRead --policy-document file://fixed.json --set-as-default

The answer shows the new version, v2, with "IsDefaultVersion": true. Without --set-as-default, the new version is stored but v1 stays in charge. A policy keeps at most five versions.