Thanks a lot for the feedback and sorry for the trouble you've been through. Actually your feedback was very informative and I'll act upon it. It was first designed to solve my need as a security engineer and then I've been adapting for others, but as you said it wasn't enough yet hehe.
And don't worry, the AWS pen test form is the last step. Well, in some sense those authorizations are important for AWS for example mainly because of the bandwidth consumed from the server perspective, even though you pay for the bandwidth anyways. They explicitly deny it for micro instances. However running 1 scanner at a time, at a low speed for example, will result in a traffic similar to a single user, thus won't affect the bandwidth in practice. In fact attackers run the very same tools without authorization, so defenders are clearly at disadvantage here.
Such authorization for providers unfortunately aren't a standard and are hard to control on my end, but the main idea is to inform that scans should not be performed blindly and you should proceed only if you know the consequences of performing a scan.
It's not explicit, but there are scanners that doesn't require this form, for example Knock, to enumerate subdomains. It works by consulting the DNS server and trying to find "mysql.yoursite.com", "admin.yoursite.com", etc ...
Nonetheless thank you Steve, and even the system not being that clear in terms of instructions, you seem to have reached the end of it. I'll work on improvements for onboarding, thank you very much.