WIP update docs

Author: matthewhilton

TAGGING.md

@@ -4,12 +4,17 @@ Tagging allows extra metadata about your files to be send to the external object
 Currently, this is only implemented for the S3 file system client. [See the S3 docs for more information](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html).
 
 **Tagging vs metadata**
+
 Note object tags are different from object metadata.
 
 Object metadata is immutable, and attached to the object on upload. With metadata, if you wish to update it (for example during a migration, or the sources changed), you have to copy the object with the new metadata, and delete the old object. This is problematic, since deletion is optional in objectfs.
 
 Object tags are more suitable, since their permissions can be managed separately (e.g. a client can be allowed to modify tags, but not delete objects).
 
+## File system setup
+### S3
+You must grant `s3:GetObjectTagging` and `s3:PutObjectTagging` permission.
+
 ## Sources
 The following sources are implemented currently:
 ### Environment
@@ -22,7 +27,7 @@ What mimetype the file is stored as under the `mdl_files` table.
 It is possible you are using objectfs with multiple environments (e.g. prod, staging) that both point to the same bucket. Since files are referenced by contenthash, it generally does not matter where they come from s
 If this is the case, for tagging to work as expected, you must ensure object override is turned off for every environment except production.
 
-This means that staging is unable to overwrite objects (thus overwriting tags) for files uploaded elsewhere. However, files uploaded elsewhere can be overwitten (hence overwriting tags) by production. This allows 
+This means that staging is unable to overwrite objects (thus overwriting tags) for files uploaded elsewhere. However, files uploaded elsewhere can be overwitten (hence overwriting tags) by production. 
 
 See this diagram for a visual explanation:
 
@@ -47,13 +52,13 @@ graph LR
     UploadObjectStaging --- Blocked
     Blocked -.-> Object
 
-    style Object fill:#ffcd75,stroke:#ffa812
-    style S3 fill:#ffd68f,stroke:#ffa812
-    style Prod fill:#c2ffcc,stroke:#26ff4a
-    style UploadObjectProd fill:#c2ffcc,stroke:#26ff4a
-    style Staging fill:#ddd9ff,stroke:#978aff
-    style UploadObjectStaging fill:#ddd9ff,stroke:#978aff
-    style Blocked fill:#ff6161,stroke:#ff0000
+    style Object fill:#ffffff00,stroke:#ffa812
+    style S3 fill:#ffffff00,stroke:#ffa812
+    style Prod fill:#ffffff00,stroke:#26ff4a
+    style UploadObjectProd fill:#ffffff00,stroke:#26ff4a
+    style Staging fill:#ffffff00,stroke:#978aff
+    style UploadObjectStaging fill:#ffffff00,stroke:#978aff
+    style Blocked fill:#ffffff00,stroke:#ff0000
 ```
 
 ## Reporting