def create_data_key(client, key_id, context=None, keyspec='AES_256'):
    """
    Create a KMS data key. Returns the plaintext key to be used for encryption
    as well as the KMS-encrypted version of the key to be stored with the
    encrypted data.
    """
    args = {'KeyId': key_id, 'KeySpec': keyspec}
    if context:
        args['EncryptionContext'] = context
    response = client.generate_data_key(**args)
    return response['Plaintext'], response['CiphertextBlob']
