title: Using AWS API: Given IAM User, Get Current Effective IAM Policy Document
body: <p>I'm having a hard time finding the correct API call to answer this question: given an IAM User, what is the effective IAM Policy document governing that user?</p>
  <p>It looks like I can accomplish the above using a combination of several API calls and concatenating the policies in the client:</p>
  <ol>
  <li><code>aws iam list-groups-for-user --user-name my-user</code></li>
  <li>for each returned group: <code>aws iam list-attached-group-policies --group-name my-group</code></li>
  <li><code>aws iam list-attached-user-policies --user-name my-user</code></li>
  <li>Concatenate policies returned from steps 2. and 3.</li>
  <li>for each policy: <code>aws iam get-policy --policy-arn my-policy-arn</code></li>
  <li>and again for each policy: <code>aws iam get-policy-version --policy-arn my-policy-arn -version-id my-version</code></li>
  </ol>
  <p>This is at fewest 5 API calls and at most an unbounded number of calls. I'm hesitant to even write this logic because it is common for a user to belong to several groups and for those groups to contain tens or hundreds of policies.</p>
  <p>Surely there is a single API endpoint somewhere that I am missing?</p>
  <p>Something like this: <code>aws iam get-effective-user-policy --user-name my-user</code></p>