diff --git a/.changelog/3106.txt b/.changelog/3106.txt
new file mode 100644
index 00000000000..88b62f189ab
--- /dev/null
+++ b/.changelog/3106.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+container: Removed restriction on `auto_provisioning_defaults` to allow both `oauth_scopes` and `service_account` to be set
+```
diff --git a/google/resource_container_cluster.go b/google/resource_container_cluster.go
index 1109beb2a11..8028d990c6b 100644
--- a/google/resource_container_cluster.go
+++ b/google/resource_container_cluster.go
@@ -267,19 +267,11 @@ func resourceContainerCluster() *schema.Resource {
 										Computed:         true,
 										Elem:             &schema.Schema{Type: schema.TypeString},
 										DiffSuppressFunc: containerClusterAddedScopesSuppress,
-										ExactlyOneOf: []string{
-											"cluster_autoscaling.0.auto_provisioning_defaults.0.oauth_scopes",
-											"cluster_autoscaling.0.auto_provisioning_defaults.0.service_account",
-										},
 									},
 									"service_account": {
 										Type:     schema.TypeString,
 										Optional: true,
 										Default:  "default",
-										ExactlyOneOf: []string{
-											"cluster_autoscaling.0.auto_provisioning_defaults.0.oauth_scopes",
-											"cluster_autoscaling.0.auto_provisioning_defaults.0.service_account",
-										},
 									},
 								},
 							},
diff --git a/website/docs/r/container_cluster.html.markdown b/website/docs/r/container_cluster.html.markdown
index c02af07416a..7b8e3c16e8e 100644
--- a/website/docs/r/container_cluster.html.markdown
+++ b/website/docs/r/container_cluster.html.markdown
@@ -378,12 +378,10 @@ for a list of types.
 The `auto_provisioning_defaults` block supports:
 
 * `oauth_scopes` - (Optional) Scopes that are used by NAP when creating node pools.
-If `oauth_scopes` are specified, `service_account` must be empty.
 
 -> `monitoring.write` is always enabled regardless of user input.  `monitoring` and `logging.write` may also be enabled depending on the values for `monitoring_service` and `logging_service`.
 
 * `service_account` - (Optional) The Google Cloud Platform Service Account to be used by the node VMs.
-If `service_account` is specified, `oauth_scopes` must be empty.
 
 The `authenticator_groups_config` block supports: