looking at the code again, I'm remembering the main motivation for making this a nested block: you can only have exactly one group sync config per organization. managing it by a resource instead means that you could theoretically specify multiple of them pointing at the same org, which would be a logic error and produce inconsistent behavior. :\

it's unfortunate that having it as a nested block doesn't work.