diff --git a/local-app/bin/tf-ssm b/local-app/bin/tf-ssm
new file mode 100755
index 00000000..c5db5a3c
--- /dev/null
+++ b/local-app/bin/tf-ssm
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# cleanup()
+# {
+#    local rstatus=$?
+#    if [[ ! -z $TMPDIR ]] && [[ -e $TMPDIR ]]
+#    then
+#      rm -rf $TMDIR
+# #     echo "rm -rf $TMPDIR"
+#    fi
+#    exit $rstatus
+# }
+# trap cleanup EXIT
+
+VERSION="1.0.0"
+THIS=$(basename $0)
+
+if [ -r /apps/terraform/etc/aws-functions.sh ]
+then
+  source /apps/terraform/etc/aws-functions.sh
+fi
+
+# see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+
+if [ ! -z "$ALT" ]
+then
+  if [[ -r "$HOME/.aws/credentials_$ALT" ]] && [[ -r "$HOME/.aws/config_$ALT" ]]
+  then
+    export AWS_SHARED_CREDENTIALS_FILE=$HOME/.aws/credentials_$ALT
+    export AWS_CONFIG_FILE=$HOME/.aws/config_$ALT
+    echo "# using alternate config/credentials files with suffix _$ALT"
+  else
+    echo "# no alternate config/credentials files found for suffix _$ALT"
+  fi
+fi
+
+if [ -z "$AWS_PROFILE" ]
+then
+  AWS_PROFILE=$(get_profile)
+fi
+if [ -z "$AWS_REGION" ]
+then
+  AWS_REGION=$(get_region)
+fi
+
+IPFILE="setup/ip-addresses-full.txt"
+if [ -e $IPFILE ]
+then
+  INSTANCE=$(head -n 1 $IPFILE | sed -e 's/^.* i-/i-/')
+#  echo -n "# using discovered instance:\n  $(head -n 1 $IPFILE)"
+fi
+if [ ! -z "$1" ]
+then
+  INSTANCE=$1
+#  echo -n "# using instance: $INSTANCE"
+fi
+
+echo "# starting session in $AWS_PROFILE region $AWS_REGION instance $INSTANCE"
+aws --profile $AWS_PROFILE --region $AWS_REGION ssm start-session --target $INSTANCE