@mazyu36 thanks for this PR - I'm curious why you added this base interface and if it is necessary?

This follows the design guidelines.
I recognize that Interfaces are essential as they are implemented across almost all resources.

https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#construct-interface

Can we add any assertions on the integ test to make sure the UserPoolGroup works as expected?

I tried to implement an assertion to verify that UserGroups are attached to the UserPool.

test.assertions.awsApiCall('cognito-identity-provider', 'ListGroupsCommand', { UserPoolId: stack.userPool.userPoolId })
  .expect(ExpectedResult.objectLike({
    Groups: [
      {
        GroupName: stack.userPoolGroup.groupName,
        UserPoolId: stack.userPool.userPoolId,
        Precedence: 1,
        Description: 'My user pool group',
        RoleArn: stack.role.roleArn,
      },
      {
        GroupName: stack.anotherUserPoolGroup.groupName,
        UserPoolId: stack.userPool.userPoolId,
      },
    ],
  }));

However, since the order of items in the result list is non-deterministic, the integration tests sometimes fail.
I think this is problematic.

Based on the assertion guidelines, I think assertion is not mandatory in this case.
What do you think?

Some things you should look for in deciding if the test needs an assertion:

- Integrations between services (i.e. integration libraries like `aws-cdk-lib/aws-lambda-destinations`, `aws-cdk-lib/aws-stepfunctions-tasks`, etc).
- All custom resources. Must assert the expected behavior of the lambda is correct.
- Anything that bundles or deploys custom code (i.e. does a Lambda function bundled with `aws-cdk-lib/aws-lambda-nodejs` still invoke or did we break bundling behavior).
- IAM/Networking connections.
  - This one is a bit of a judgement call. Most things do not need assertions, but sometimes we handle complicated configurations involving IAM permissions or
    Networking access.

@mazyu36 thank you for the detailed clarification

Maybe overkill, but can we also add an integ test to confirm that a UserPoolGroup without precedence passed in deploys?

Thank you. I modified AnotherUserPoolGroup to deploy without precedence.

I'm curious, is this how we normally perform string validations in CDK? Do you have any similar examples that use this?

The following is the similar implementation:

Regex pattern is quoted from CFn Doucument.
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolgroup.html#cfn-cognito-userpoolgroup-groupname

Thanks for this PR @mazyu36 - one followup question, you mention in the README here that user pools enable you to also remove users from groups as well, but I don't see any functions that do this? Can you clarify? (My understanding might be off here)

Thanks.
I've updated README.

Since there is no remove method, I have deleted it.
A remove method is unnecessary because users can be deleted by deleting the add method from implementation.
Other add methods also do not have corresponding remove methods.

Thanks @mazyu36 - overall API design looks good to me.