Compliance and Data Residency in Active-Active AWS Setups

Act as a Cloud Compliance and Legal Architecture Expert. Develop an uncompromising, mathematically verifiable governance and compliance model tailored for a complex active-active database architecture spanning multiple sovereign international jurisdictions. The infrastructure must definitively align with the rigid controls of the [GOVERNANCE_FRAMEWORK] (e.g., BaFin, HIPAA) covering highly sensitive [DATA_CLASSIFICATION] schemas. You must technically address extreme [RESIDENCY_RESTRICTIONS] (e.g., German user data physically cannot leave the `eu-central-1` boundary) by architecting region-specific application-level data filtering and isolated localized storage pools. Detail the exact deployment of automated AWS Config rules and highly restrictive IAM Service Control Policies (SCPs) applied at the AWS Organizations root level to physically and cryptographically prevent any IAM role from ever replicating protected data into legally prohibited regions.