Specifies whether root can log in using ssh(1). The argument must be
“yes”, “without-password”, “forced-commands-only”, or “no”. The
default is “yes”.
If this option is set to “without-password”, password
authentication is disabled for root.
If this option is set to
“forced-commands-only”, root login with public key authentication will
be allowed, but only if the
command option has been specified (which
may be useful for taking remote backups even if root login is normally
not allowed). All other authentication methods are disabled for root.
If this option is set to “no”, root is not allowed to log in.
The PermitRootLogin option only allows key-based authentication.
Key-Auth vs. Pass-Auth
It's perfectly normal for your cloud host to provide you a root-login password with Key-Auth enabled. Perhaps they are expecting you to login via serial console through their administration panel. You know what I'm talking about, right? Accessing a VTY from their server. Bouncing from the admin panel into your VM.
When you have access, generate SSH keys.