Someone on Reddit posted a shell script[1] that does all the connection setup, key-sending, etc that's a useful base to work from.

[1] https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_...