Add existing Lambda to Cloudfront behaviour (Viewer Request)

I am trying to link an existing Lambda@Edge to the Viewer Request during the deploy. The Lambda does not change and is uesd on one stage for password protecting access to the site.

Where can I add this behaviour in the template to auto deploy on each deploy? A new deploy currently removes the protection and requires manually adding each time