text: Title: change service port with aws nlb ，old security group rules not deleted
  Body: <!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!-->
  
  
  **What happened**:
  I deployed a cluster on aws and created a loadbalance type service. When I modify the port of this service, the value of nodeport, loadbalance on aws will only add a new port in the security group, and will not delete the port that was originally opened.
  
  **What you expected to happen**:
  Delete the original opened port, only keep the new port
  
  **How to reproduce it (as minimally and precisely as possible)**:
  create a service like this：
  svc.yaml
  kind: Service
  apiVersion: v1
  metadata:
    name: my-service
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-type: nlb
  spec:
    selector:
      app: nginx
    ports:
    - name: internet-nlb
      nodePort: 30080
      port: 30080
      protocol: TCP
      targetPort: 80
    type: LoadBalancer
  
  then securiy group will add two rules:
  
  Custom TCP Rule | TCP | 30080 | 0.0.0.0/0 | kubernetes.io/rule...
  
  Custom TCP Rule | TCP | 30080 | 172.31.0.0/16 | kubernetes.io/rule...
  
  then I modify the service port,change nodeport to 30081,port to 30081
  
  then securiy group will be
  Custom TCP Rule | TCP | 30080 | 0.0.0.0/0 | kubernetes.io/rule...
  
  Custom TCP Rule | TCP | 30080 | 172.31.0.0/16 | kubernetes.io/rule...
  
  Custom TCP Rule | TCP | 30081 | 0.0.0.0/0 | kubernetes.io/rule...
  
  Custom TCP Rule | TCP | 30081 | 172.31.0.0/16 | kubernetes.io/rule...
  
  I think the rules contain 30080 should be removed,no server is open to 30080 now
  
  **Anything else we need to know?**:
  
  **Environment**:
  - Kubernetes version (use `kubectl version`):
  v1.11.2
  - Cloud provider or hardware configuration:
  - OS (e.g. from /etc/os-release):
  CentOS Linux 7 (Core)
  - Kernel (e.g. `uname -a`):
  Linux enn-2-129 3.10.0-693.el7.x86_64
  - Install tools:
  install k8s cluster with binary and Configuration file 
  - Others:
  
  <!-- DO NOT EDIT BELOW THIS LINE -->
  /kind bug