Using AWS KMS with AES GCM
Yes, you are in the ballpark with your assumptions. 


  
  I will store the encryptedKey with the encrypted data, but can I use the same key for all rows or do I need to generate a new one for each one?
  


No you can use the same key.


  
  How does the AAD factor into this? Do I need to store it? Does it need to be unique per row?
  


If you don't need AAD then you don't need to supply it. AAD means "additional authenticated data", i.e. any data you also want to be authenticated together with the ciphertext, which you want to keep in plaintext.


  
  Do I need to generate a new nonce for each row of data? Can I store it together with the data?
  


Yes to both.



Notes on the implementation:



GCMParameterSpec spec = new GCMParameterSpec(16 * 8, nonce);


You should not use "magic literals". Instead use something like Cipher.getBlockSize() * Byte.SIZE. You would of course need to define the cipher earlier. Same goes for the number 12, use a constant e.g. GCM_DEFAULT_NONCE_SIZE_BYTES.



byte[] aad = "Whatever I like".getBytes();
byte[] cipherText = cipher.doFinal(data.getBytes());


You need to specify an explicit encoding here. StandardCharsets.UTF_8 is popular, and not without reason.



Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding", "BC");


Oracles provider also contains GCM, and that may perform much better than the Bouncy Castle one (which will always be programmed in Java). In general, don't specify a provider unless you really need to (and then you may want to make it configurable).