Which IAM permissions are needed for ec2-create-image?

Unfortunately you can't lock this down on a resource level at the moment. There are a bunch of EC2 actions that doesn't support resource level permissions and ec2:CreateImage is one of them.

Creating image also involves creation of snapshots attached to that instance. Below IAM policy should work.

{     
  "Effect": "Allow",
  "Action": [
    "ec2:Describe*",
    "ec2:CreateSnapshot",
    "ec2:CreateImage"
  ],
  "Resource": [
    "*"
  ]
}