What happened:
AWS Cloud provider creates an additional AWS Security Group per LoadBalancer defined in Kubernetes Service configuration in case if it's already defined by service.beta.kubernetes.io/aws-load-balancer-security-groups annotation

What you expected to happen:
Don't create an additional SG and don't rewrite rules on SG provided by aws-load-balancer-security-groups annotation

How to reproduce it (as minimally and precisely as possible):

1. Create SG with rules for ELB
2. Create a K8S service with existing SG defined by annotation service.beta.kubernetes.io/aws-load-balancer-security-groups and Type: LoadBalancer
   For example,

$ kubectl describe service some-service
Name:  some-service

Annotations: service.beta.kubernetes.io/aws-load-balancer-security-groups: sg-some-id
....
Type:  LoadBalancer

3. Then AWS Cloud provider creates an additional SG and replaces custom rules to the existing Security Group
   Anything else we need to know?:
   Creates SG by cloud provider:
   
   My custom SG after several seconds after service creation:
   

Environment:

• Kubernetes version (use kubectl version):
  v1.14.8-eks-b7174d
• Cloud provider or hardware configuration:
  AWS

/kind bug