I want to add that this is for AWS (Amazon web services) You can verify that their invoicing works on a 30 Day basis - And is billed on the following 2nd/3rd - There is no change for us to take advantage of you, we simply want to pay our bill. You will be able to login, and see the balance, add the card, and remove it.
What would be run on those AWS instances? Any illegal website?
This is the main concern. If it is some deepweb or bot network the police will only have your creditcard details as evidence. To make it worse you have to proof it wasn't you.
Perhaps op should be more transparent and offer the party that helps him infomartion about him/herself.