diff --git a/vault/client.go b/vault/client.go
index 7e80fa276..1be1ed0ba 100644
--- a/vault/client.go
+++ b/vault/client.go
@@ -12,6 +12,9 @@ import (
 	"time"
 )
 
+// logFatal is defined so log.Fatal calls can be overridden for testing
+var logFatal = log.Fatal
+
 // Client -
 type Client struct {
 	Addr *url.URL
@@ -37,9 +40,14 @@ func NewClient() *Client {
 
 func getVaultAddr() *url.URL {
 	vu := os.Getenv("VAULT_ADDR")
+	if vu == "" {
+		logFatal("VAULT_ADDR is an unparseable URL!")
+		return nil
+	}
 	u, err := url.Parse(vu)
 	if err != nil {
-		log.Fatal("VAULT_ADDR is an unparseable URL!", err)
+		logFatal("VAULT_ADDR is an unparseable URL!", err)
+		return nil
 	}
 	return u
 }
@@ -51,6 +59,7 @@ func getAuthStrategy() AuthStrategy {
 	if auth := NewTokenAuthStrategy(); auth != nil {
 		return auth
 	}
+	logFatal("No vault auth strategy configured")
 	return nil
 }
 
@@ -83,7 +92,7 @@ func (c *Client) Do(req *http.Request) (*http.Response, error) {
 func (c *Client) Login() error {
 	token, err := c.Auth.GetToken(c.Addr)
 	if err != nil {
-		log.Fatal(err)
+		logFatal(err)
 		return err
 	}
 	c.token = token
diff --git a/vault/client_test.go b/vault/client_test.go
index b25c9e11c..9d37f2371 100644
--- a/vault/client_test.go
+++ b/vault/client_test.go
@@ -1,12 +1,48 @@
 package vault
 
 import (
+	"log"
 	"net/url"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 )
 
+var spyLogFatalMsg string
+
+func restoreLogFatal() {
+	logFatal = log.Fatal
+}
+
+func mockLogFatal(args ...interface{}) {
+	spyLogFatalMsg = (args[0]).(string)
+}
+
+func setupMockLogFatal() {
+	logFatal = mockLogFatal
+	spyLogFatalMsg = ""
+}
+func TestNewClient_NoVaultAddr(t *testing.T) {
+	os.Unsetenv("VAULT_ADDR")
+	defer restoreLogFatal()
+	setupMockLogFatal()
+	c := NewClient()
+	assert.Nil(t, c.Addr)
+	assert.Equal(t, "VAULT_ADDR is an unparseable URL!", spyLogFatalMsg)
+}
+
+func TestLogin_NoAuthStrategy(t *testing.T) {
+	os.Setenv("VAULT_ADDR", "https://localhost:8500")
+	os.Unsetenv("VAULT_APP_ID")
+	os.Unsetenv("VAULT_USER_ID")
+	os.Setenv("HOME", "/tmp")
+	defer restoreLogFatal()
+	setupMockLogFatal()
+	_ = NewClient()
+	assert.Equal(t, "No vault auth strategy configured", spyLogFatalMsg)
+}
+
 func TestLogin_SavesToken(t *testing.T) {
 	auth := &TokenAuthStrategy{"foo"}
 	client := &Client{