PCI DSS 1.2.1 states:
Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment.
Verify that all other inbound and outbound traffic is specifically denied, for example by using an explicit "deny all" or an implicit deny after allow statement
The servers in our DMZ need to make outbound calls to a number of external services (mostly through HTTPS APIs). Most of these services have their own high-availability setups with low-TTL DNS records, and are liable to add or change IP addresses at any time.
Therefore it does not seem feasible to restrict outbound traffic on our firewall based on IP address, because the rules would be constantly out of date and an admin nightmare.
I've seen that some firewalls support FQDN-based rules, which sounds like it could solve the problem, but unfortunately neither our ISP nor others I've looked at (Rackspace, AWS, etc.) support FQDN-based firewall rules. We'd prefer not to have to move hosting providers.
Another solution is to set up a completely separate external hosting environment (complete with it's own redundancy and authentication) that is simply used to proxy all non-credit-card outgoing traffic. Then we'd only have to allow the IP of our proxy. This feels like overkill, and I struggle to believe it's the best solution.
Surely we cannot be the only PCI compliant company that has to deal with such dynamic outbound traffic rules? How are other companies solving this problem?