diff --git a/README.md b/README.md
index 9e235c9..196ce92 100644
--- a/README.md
+++ b/README.md
@@ -13,13 +13,12 @@ structure so they are not really needed. The bucket is `inf-tfstate-{account_id}
 
 This has no other dependencies, since it has to be created first.  Only one is needed per account.
 
-### splunk-user
-
 ### [access-logging](access-logging)
 
 This sets up the S3 bucket used for access logs.  One is needed per region, and the region and account are included
 in the bucket names: `inf-logs-{account_id}-{region}`. 
 
+### splunk-user
 ### object-logging
 ### cloudtrail
 ### config