The VPC staging has the route tables web (for web-a and web-b) and data (for data-a and data-b). The web subnets must become public; the data subnets must not.

1. Keep the VPC's id in VPC:

   sh

   copy

   VPC=$(aws ec2 describe-vpcs --filters Name=tag:Name,Values=staging --query "Vpcs[0].VpcId" --output text)

2. Create an internet gateway named staging, keeping its id in IGW, and attach it to the VPC.

3. Decide which route table needs the route to the gateway, keep its id in RT, and add the route.

4. Read that table's routes to check.