AES is a family of three pairs of functions that use essentially the same mechanisms with different tuning parameters: AES-128 encryption and decryption, AES-192 encryption and decryption, and AES-256 encryption and decryption. Each of these functions takes an $n$-bit key (where $n$ is 128, 192 or 256 depending on whether the function is AES-128, AES-192 or AES-256) as well as a 128-bit block as parameters, and returns a 128-bit block.
(If your data doesn't consist of exactly 128 bits, you need to apply a mode of operation around AES. When you use
openssl enc, you need to select a mode of operation in addition to the key size, e.g.
aes-256-cbc specifies the mode CBC with PKCS#5 padding. CBC specifies how to encrypt multiple 128-bit blocks, and PKCS#5 specifies how to pad the message to a whole number of blocks.)
AES-256 requires a 256-bit key, period. However there are different ways of building that 256-bit key. One way is to generate 256 random bits and take them as the key. You need to store these 256 bits somewhere, or you won't be able to decrypt what you've encrypted. Another way is to derive the key from some other material in a way that can be reproduced later; this is done, for example, when you only have a few hundred bits of storage and need to construct many different keys from that.
If you need the key to be memorable to a human user, presenting it as 64 hexadecimal digits or some other encoding of 256 random bits isn't practical. Instead, one method to obtain a key is to let the user enter a password (or passphrase, the two words are synonyms as far as cryptography is concerned), and derive the key from the password. The encryption algorithm doesn't operate on the password, it needs a key of exactly 256 bits.
A way to turn a password into a key is called a password-based key derivation function. Such a derivation is inherently problematic because a password doesn't have the same security properties as a random key: it has a lot less entropy (so there's a risk that it will be guessed, unlike a random key), and it can be reused (so an adversary who obtains the key from one application might be lucky with another application, unlike a random key which is practically guaranteed to be unique). Hence a password-based key derivation includes a unique salt and performs stretching to reduce the opportunity for brute-force attacks. For a thorough discussion of password hashing, which is very similar to password-based key derivation, see this answer on Security Stack Exchange.
When you specify a password instead of a key, OpenSSL applies a homemade key derivation function to the password which includes appropriate salting but only the barest amount of stretching. This means that it is very fast to attempt decryption with a guessed password.