There are three things that can cause it, and the two discussed by everyone else here don't cover a common scenario that's arising with AWS-deployed AMIs.
PasswordAuthentication no - don't allow password authentication
ChallengeResponseAuthentication no - don't challenge the user for authentication (could be password or other keyboard-interactive)
AuthenticationMethods publickey - only allow someone to login after they've authed via publickey
Change these to:
PasswordAuthentication yes - allow password authentication
ChallengeResponseAuthentication yes - allow the user to be challenged
AuthenticationMethods any - allow any valid form of authentication to succeed
I think you may find
ChallengeResponseAuthentication yes to be optional, I'm just including it here for thoroughness.