diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk.ts b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
index e8489776ceebc..9d28ed7958bd6 100644
--- a/packages/aws-cdk/lib/api/aws-auth/sdk.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
@@ -530,10 +530,7 @@ export class SDK {
   /**
    * STS is used to check credential validity, don't do too many retries.
    */
-  private readonly stsRetryOptions = {
-    maxRetries: 3,
-    retryDelayOptions: { base: 100 },
-  };
+  private readonly stsRetryStrategy = new ConfiguredRetryStrategy(3, (attempt) => 100 * (2 ** attempt));
 
   /**
    * Whether we have proof that the credentials have not expired
@@ -950,7 +947,7 @@ export class SDK {
         debug('Looking up default account ID from STS');
         const client = new STSClient({
           ...this.config,
-          ...this.stsRetryOptions,
+          retryStrategy: this.stsRetryStrategy,
         });
         const command = new GetCallerIdentityCommand({});
         const result = await client.send(command);
@@ -977,7 +974,7 @@ export class SDK {
       return;
     }
 
-    const client = new STSClient({ ...this.config, ...this.stsRetryOptions });
+    const client = new STSClient({ ...this.config, retryStrategy: this.stsRetryStrategy });
     await client.send(new GetCallerIdentityCommand({}));
     this._credentialsValidated = true;
   }