Where to place AutoMapper.CreateMaps?

Doesn't matter, as long as it's a static class. It's all about convention.

Our convention is that each "layer" (web, services, data) has a single file called AutoMapperXConfiguration.cs, with a single method called Configure(), where X is the layer.

The Configure() method then calls private methods for each area.

Here's an example of our web tier config:

public static class AutoMapperWebConfiguration
{
   public static void Configure()
   {
      ConfigureUserMapping();
      ConfigurePostMapping();
   }

   private static void ConfigureUserMapping()
   {
      Mapper.CreateMap<User,UserViewModel>();
   } 

   // ... etc
}

We create a method for each "aggregate" (User, Post), so things are separated nicely.

Then your Global.asax:

AutoMapperWebConfiguration.Configure();
AutoMapperServicesConfiguration.Configure();
AutoMapperDomainConfiguration.Configure();
// etc

It's kind of like an "interface of words" - can't enforce it, but you expect it, so you can code (and refactor) if necessary.

EDIT:

Just thought I'd mention that I now use AutoMapper profiles, so the above example becomes:

public static class AutoMapperWebConfiguration
{
   public static void Configure()
   {
      Mapper.Initialize(cfg =>
      {
        cfg.AddProfile(new UserProfile());
        cfg.AddProfile(new PostProfile());
      });
   }
}

public class UserProfile : Profile
{
    protected override void Configure()
    {
         Mapper.CreateMap<User,UserViewModel>();
    }
}

Much cleaner/more robust.

You can really put it anywhere as long as your web project references the assembly that it is in. In your situation I would put it in the service layer as that will be accessible by the web layer and the service layer and later if you decide to do a console app or you are doing a unit test project the mapping configuration will be available from those projects as well.

In your Global.asax you will then call the method that sets all of your maps. See below:

File AutoMapperBootStrapper.cs

public static class AutoMapperBootStrapper
{
     public static void BootStrap()
     {  
         AutoMapper.CreateMap<Object1, Object2>();
         // So on...


     }
}

Global.asax on application start

just call

AutoMapperBootStrapper.BootStrap();

Now some people will argue against this method violates some SOLID principles, which they have valid arguments. Here they are for the reading.

Configuring Automapper in Bootstrapper violates Open-Closed Principle?