AWS EKS : setting aws-load-balancer-manage-backend-security-group-rules to false is not working for Classic Load Balancers

Hi,

I'm using a common security group which is internal security group for all my internal apps. The problem is, when one of the apps & its load balancer is deleted from the cluster, the rule that is permitting internal security group to EKS control plane security group is also being deleted. After this, suddenly all my internal app load balancers that is using same internal security group are starting to fail, I have to add this rule after every load balancer deletion process in this environment. After some research; I found this annotation,

`service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules: "false"`

But after adding this to load balancer yaml and trying deletion, I realized that it's not working because rule is deleted again.

My questions are ;

- Is it possible to keep security group rule in control plane security group even when the load balancer that is using that rule is deleted?
- If this annotation is not working for my case, is there any workaround for my situation?

Here is my YAML; It's creating Classic LB with existing security group.

```
apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
service.beta.kubernetes.io/aws-load-balancer-security-groups: "sg-xxx"
service.beta.kubernetes.io/aws-load-balancer-ssl-cert:
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
service.beta.kubernetes.io/aws-load-balancer-manage-backend-security-group-rules: "false"
name: custom-svc
namespace: default
spec:
ports:
- name: http
port: 80
protocol: TCP
targetPort: 1234
- name: https
port: 443
protocol: TCP
targetPort: 1234
selector:
app: custom-app
sessionAffinity: None
type: LoadBalancer
```

Thank you very much.

Use the supplied Kubernetes Service YAML and the aws-load-balancer-manage-backend-security-group-rules annotation as the reproduction entry point. Create and delete the Classic Load Balancer, then verify whether the rule permitting the shared internal security group is removed from the EKS control-plane security group. Done means establishing whether the annotation should preserve that rule and documenting a confirmed workaround if it cannot.

Written by the indexing model from the issue text.