move public data access info block

content/en/admin/optional/object-storage.md

@@ -65,6 +65,12 @@ Despite the name it is not AWS specific.
 
 **Default:** _None_
 
+{{< hint style="info" >}}
+The access id/key must provide Mastodon the ability to write data to your S3 bucket.
+You must also set up your S3 bucket to ensure that all objects are publicly readable, but only writable or listable with proper authentication.
+Consult your provider documentation for assistance.
+{{</ hint >}}
+
 ### Client Access Variables
 
 Once S3 file storage is enabled, Mastodon will provide new URLs for all media 'read' operations.
@@ -174,12 +180,6 @@ Use caution when using [S3 Block Public Access](https://docs.aws.amazon.com/Amaz
 In that configuration you should set `S3_PERMISSION` to `private`.
 {{</ hint >}}
 
-{{< hint style="info" >}}
-Regardless of the ACL configuration, your S3 bucket must be set up to ensure that all objects are publicly readable but not writable or listable.
-Mastodon itself should also have write access to the bucket.
-This configuration is generally consistent across all S3 providers.
-{{</ hint >}}
-
 #### `S3_BATCH_DELETE_LIMIT`
 
 The official [Amazon S3 API](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html) can handle deleting 1,000 objects in one batch job, but some providers may have issues handling this many in one request, or offer lower limits.